Request letter templates

GDPR subject access request template: a letter you can copy

Quick answer

Copy the letter below, fill in the [brackets] and send it to the company's privacy contact or Data Protection Officer. You don't need an official form or a reason: the EDPB says it's enough to say you want to know what personal data the company processes about you. The company must reply free of charge within one month.

“In order to make the access request, it is sufficient for the requesting persons to specify that they want to know what personal data concerning them the controller processes.”

All privacy laws
Applies in
European Union
In force since
Companies must answer within
Without undue delay and within one month of receipt. The company can add up to two further months for complex or numerous requests if it tells you, with reasons, within the first month (GDPR Article 12).
Regulator
National data protection authorities (listed by the European Data Protection Board)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: edpb.europa.eu, eur-lex.europa.eu, publications.europa.eu

Last verified against the official page:

How we research this Report an error

Anyone whose personal data is processed by a company or organisation covered by the GDPR in the EU or EEA.

Your rights

  • Right of access

    Confirmation that the company processes your data, a copy of it, and the supporting information listed in points 2 to 8 of the letter (Article 15).

  • Free of charge

    A request costs nothing unless it's manifestly unfounded or excessive. The first copy is free; further copies may carry a reasonable fee (Article 12 and Article 15).

  • Right to complain

    If the company doesn't answer properly, you can complain to a data protection authority, in particular where you live or work (Article 77).

General information, not legal advice.

How to use it

  1. 1

    Find the controller or its DPO

    Send the letter to the company that processes your data. Its privacy notice usually gives a privacy email address, and if it has a Data Protection Officer you can address it to the DPO.

  2. 2

    Send it through any channel the company offers

    Email is fine, and so is the company's own privacy form if it has one (paste the letter in). The GDPR sets no requirements for the form or channel, and the EDPB says a request sent through a channel the company provides should generally be treated as effective, even if it isn't the preferred one.

  3. 3

    Keep proof of sending

    Save the sent email, take a screenshot of an online form, or keep proof of postage. You'll need it if you complain later.

  4. 4

    Answer reasonable ID or clarification requests

    A company with reasonable doubts about your identity can ask for more information. The EDPB says asking for a copy of your ID card should generally not be considered appropriate and suggests alternatives such as confirmation links or codes.

  5. 5

    Escalate if the month passes

    Complain to your national data protection authority, in particular where you live or work (find it on the EDPB members list). Our GDPR page walks through it.

No answer in time? Complain to National data protection authorities (listed by the European Data Protection Board) .

The letter

Fill in the parts in [brackets] before you send it. 

Subject: Subject access request under Article 15 GDPR

[Your full name]
[Your postal address]
[Your email address]
[Date]

To: [Company name], Data Protection Officer or privacy team
[Company postal address or privacy email address]

Dear Data Protection Officer,

I am making a subject access request under Article 15 of the General Data Protection Regulation (GDPR).

Please confirm whether you process personal data about me. If you do, please send me:

1. a copy of all the personal data you hold about me;
2. the purposes for which you process it;
3. the categories of personal data concerned;
4. the recipients or categories of recipients to whom you have disclosed it;
5. how long you plan to keep it or, if that isn't possible, the criteria you use to decide;
6. where you got it, if you did not collect it from me;
7. whether you use it for automated decision-making, including profiling, and if so, meaningful information about the logic involved and the likely consequences for me;
8. information about my right to ask for rectification, erasure or restriction, my right to object, and my right to complain to a supervisory authority.

To help you find my data:
- Name(s) I have used with you: [current and any previous names]
- Email addresses and phone numbers you may hold: [list]
- Account, customer or reference number: [number, if any]
- [Optional, delete this line if you want everything: I am especially interested in [topic] between [date] and [date].]

Please send the information electronically, in a commonly used format, to [email address].

Under Article 12(3) of the GDPR you must respond without undue delay and within one month of receiving this request. Under Article 12(5), it must be free of charge. If you have reasonable doubts about my identity, please tell me what you need and I will provide only what is necessary to confirm it.

If I do not receive a full response within one month, I may lodge a complaint with [name of your national data protection authority] under Article 77.

Yours sincerely,

[Your name]

In the UK? Use our UK subject access request template instead.

What the letter asks for, and why

Points 2 to 8 follow Article 15(1) of the GDPR, which lists what you're entitled to on top of the data itself. You don't have to ask for them by name. The EDPB says that if you don't clearly limit a request, the company should treat it as a request for everything under Article 15. Listing them anyway makes it harder to send back a half answer.

The identifying details are there so the company can find your records quickly. Give only what helps it find you. If it holds data under an old email address or a previous name, include those, because that's where it will look.

The optional line about a topic or date range is useful when you only care about one thing, say your account history with a retailer. Leave it out if you want everything.

Before you send it

Check the company's privacy notice for a dedicated privacy email or form. Sending to the general support inbox still counts, but it can slow things down.

Put the date you sent it in your calendar, plus one month. That's your deadline to escalate.

Where Serus fits

An access request tells you what one company holds. Data brokers and people-search sites are many companies, and most people want their data gone rather than copied back to them. Serus finds the brokers that operate where you live and sends removal requests, then follows up when deadlines pass. To ask one company what it knows about you, this letter is all you need. Run a free scan to see where else you're listed.

Data brokers that list people in European Union

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Do I have to use an official form?

No. The GDPR sets no requirements for the form of an access request.

Do I need to say why I want my data?

No. The EDPB says you don't have to give reasons.

Is there an official GDPR subject access request template?

The EDPB gives example phrasings rather than a full letter. The letter on this page is built from Article 15 and that guidance.

Can they demand a copy of my passport?

They can only ask for what's necessary to confirm who you are. The EDPB says copying ID cards should generally not be considered an appropriate way to check identity.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.