Subject access request under the GDPR (Art. 15)
When you need the letter, what must be in it and a fully written example – one tap opens it filled in, ready to save as a PDF.
Tool: Letter template (DIN 5008)
When do you need this letter?
You want to know what data a company, club or public body holds about you – for example after marketing you never asked for. Under Article 15 GDPR you have a right to access and to a copy of your data. You do not need to give a reason.
The organisation must usually reply within one month. In complex cases this can be extended by up to two further months, but they have to tell you.
What goes in it
Details that identify you: name, address, customer number, e-mail
A request to confirm whether your data is processed
The points of Art. 15: purposes, categories, recipients, retention period, source, automated decisions
A request for a copy of the data
Deadline: one month
Example letter
Jana Beispiel
12 Linden Street
Bristol BS1 4AA
030 23125 015 · jana.beispiel@example.com
Example Shopping Ltd
Data Protection Officer
3 Market Way
London EC1A 1AA
DD Month YYYY
Subject access request under Article 15 GDPR – customer number 5544-21
Dear Sir or Madam,
Please confirm whether you process personal data about me. If you do, I request access under Article 15 GDPR to that data, the purposes of the processing, the recipients, the intended retention period, the source of the data and whether any automated decision-making, including profiling, takes place.
I also request a copy of the data under Article 15(3) GDPR, preferably as a PDF by e-mail to jana.beispiel@example.com.
I expect your reply within one month of receiving this letter. To identify me: I am registered with you under customer number 5544-21 and the e-mail address jana.beispiel@example.com.
Yours faithfully,
Jana Beispiel
Sender, recipient and numbers are fictional. Replace them with your details – in the tool everything is already filled in.
Good to know
- Access is free of charge. A reasonable fee may be charged for further copies.
- Send the request to the data protection officer or the address given in the privacy notice; e-mail is fine.
- If you get no or an incomplete answer, you can complain to the data protection supervisory authority.
- In the UK the UK GDPR applies with the same right of access.
Not legal advice: the template shows a common structure. Deadlines and formal requirements depend on your case. If a lot is at stake, get advice – for example from a consumer advice centre or a lawyer.
Frequently asked questions
Can the company ask for my ID?
Only if it has reasonable doubts about your identity. Then it may ask for further information. If you send a copy of an ID document, black out everything except your name, address and validity.
How to send it
Send important letters in a way you can prove, for example by recorded delivery or by e-mail to the address the organisation names for data protection requests. Keep a copy.