Data Access Request
Asks an organisation for the personal data it holds about you.
Details
subject access request templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
I am making a request for access to the personal data you hold about me, under the privacy legislation applicable in my state.
Specifically, I am asking for all personal data you hold about me.
Along with the data itself, please tell me why you hold it, who you have shared it with, how long you keep it, and where you obtained it if not from me.
You can identify me by: [how they can identify you]. If you need more to verify my identity, tell me exactly what and I will provide it.
Please respond within the period your legislation allows. Please send the response to the address above.
What is a Data Access Request?
A subject access request is a letter asking an organisation to give you the personal data it holds about you. You do not need a reason, you do not have to pay, and in most systems the organisation has a fixed period to reply. It is the most useful consumer letter almost nobody sends: what comes back is often the internal notes, call recordings and decision records that a complaint alone would never surface.
People send these when a complaint has gone nowhere, when they want to know why an application was refused, when a former employer's account of events differs from theirs, or simply to find out what a company knows. The request reaches customer records, account notes, emails mentioning you, call recordings, CCTV footage where you are identifiable, and the reasoning behind automated decisions. Organisations that would never volunteer that material must hand it over when it is properly requested.
The right exists under different names in different places. In the United Kingdom it sits under Article 15 of the UK GDPR and the organisation normally has one month to respond, extendable in limited circumstances. The European Union uses the same article of the GDPR. Australia has Australian Privacy Principle 12. India has the Digital Personal Data Protection Act, 2023. The United States has no single federal equivalent, but several states — California most prominently — give comparable rights with their own deadlines. Check the rule where the organisation is established.
The request gets you data about you. It does not give you another person's data, does not entitle you to documents merely because you are mentioned in them in passing, and does not override legal professional privilege or, in some cases, material relating to an ongoing investigation. Exemptions are narrower than most organisations claim, though: a company that redacts almost everything and cites confidentiality has usually overreached, and that is worth challenging.
What to put in a Data Access Request
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Issued to (full name) | For example: James Whitfield |
| Home address | For example: 588 Kinnear Road |
| Organisation | For example: Barton Software Ltd |
| Organisation address | For example: 1420 Kinnear Road, Columbus, OH 43212 |
| What you are asking for | Free text |
| Period optional | For example: January 2024 to date |
| How they can identify you | For example: Account 4471-889, registered to this address |
How to write a Data Access Request
Send it to the right person in the organisation
Large organisations have a data protection officer or a privacy team, and the address is usually in the privacy notice on their website. Sending it to a general customer service inbox works legally in most systems — the clock starts when the organisation receives it, however it arrives — but it can sit unread for a fortnight. Address it properly and the deadline is more likely to be met.
Say clearly that it is a data access request
Use the words the organisation's staff are trained to recognise: subject access request, or request under Article 15, or the equivalent name where you are. A letter that reads as a complaint asking for information gets handled as a complaint, and the statutory clock may never start. Put the phrase in the subject line and the first sentence.
Identify yourself the way their records do
Give the account number, customer reference, policy number, order number or employee number they will search on, plus any previous name or address you used with them. The single most common cause of delay is an organisation being unable to find you, and the second is them asking for identification. Offer proportionate identification up front and the process moves faster.
Be specific about what you want, or ask for everything
Both approaches work and they suit different situations. Asking for everything is comprehensive but slow, and the organisation may ask you to narrow it. Asking for call recordings from a specific month, or the notes behind a specific decision, gets a faster and more useful answer. If you want something particular, name it — and name the date range.
State the deadline and keep proof of sending
Say when you expect the response, based on the period that applies where you are. Send by a method that gives you evidence — recorded delivery, or email with a read receipt — and keep a copy of what you sent. If the deadline passes with no substantive reply, you have a clean record to take to the regulator, and that record is what makes the escalation quick.
Common mistakes
- Writing a complaint that happens to ask for information, so the organisation never recognises it as a statutory request.
- Omitting the account or reference number, which leaves the organisation searching by name across systems that do not match.
- Accepting a demand for identification that goes beyond what is proportionate, such as a certified passport copy for an online account.
- Failing to keep proof of the date it was sent, which makes the deadline impossible to enforce.
- Giving up when the response is heavily redacted, rather than asking which exemption is being relied on for each redaction.
Frequently asked questions
How long does an organisation have to respond?
It depends on the law that applies. In the United Kingdom and the European Union the period is normally one month from receipt, extendable by a further two months for complex or numerous requests, with the organisation obliged to tell you within the first month if it is extending. Australia, India and the various United States state laws set their own periods. Check the applicable rule and state it in your letter.
Can a company charge me for a subject access request?
Generally no. Under the UK and EU regimes the first copy is free, and a fee may only be charged where a request is manifestly unfounded or excessive, or for further copies. Other regimes take a similar approach. If you are asked to pay for a first, reasonable request, ask on what basis the fee is charged rather than paying it.
What can I actually ask for?
The personal data the organisation holds about you, plus information about how it is being used: the purposes, the categories of data, who it has been shared with, how long it will be kept, and where it came from if not from you. That last item is often the useful one. It reaches internal notes, emails, call recordings and CCTV in which you are identifiable.
What if they ignore me or refuse?
Complain to the organisation first, in writing, referring to your original request and its date. If that fails, escalate to the supervisory authority — the Information Commissioner's Office in the United Kingdom, the relevant data protection authority in an EU member state, the Office of the Australian Information Commissioner, or the equivalent where you are. Attach your proof of sending and their response or lack of it.
Can I make a request on behalf of someone else?
Usually yes, with their written authority, and organisations will normally ask to see it. Parents can often request on behalf of young children, though older children may have the right to make their own request. Requests about someone who has died are treated differently, because data protection rights generally attach to living people — a different route usually applies.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.