GDPR subject access request (Article 15)
A subject access request shows what data a company holds on you, where it came from and who received it; it is ideal evidence before asking for erasure.
Template
To: [Company name], Data Protection Officer
Subject: Subject access request under Article 15 GDPR
Please provide:
1. confirmation whether you process personal data concerning me and a copy of it;
2. the purposes and categories of data;
3. the recipients to whom the data have been or will be disclosed;
4. the retention period;
5. the source of the data, where not collected from me;
6. whether automated decision-making or profiling is used.
Identifiers you may hold: [name, email, phone, username, URL].
Please respond within one month (Art. 12(3)).
[Full name] [Date] [Email]Notes
The first copy is free. A company may ask for reasonable identity checks; question excessive demands.
General information, not legal advice. In real cases we work alongside lawyers who specialise in digital rights.
Frequently asked questions
Why start with access rather than erasure?
The reply reveals the source, so you can send erasure requests upstream and stop the data spreading again.