Your right to access personal data (Article 15 of GDPR) lets you request a complete copy of all information a company holds about you — for free, within 30 days. This is the first step to understanding your data footprint and the foundation for any further action (deletion, correction, portability).
Why Request Your Data?
Before you delete your data or file a complaint, you need to know what a company actually stores:
- See what's tracked: emails, phone numbers, IP logs, purchase history, browsing behavior, profile data, inferred preferences.
- Find inaccuracies: catch misspelled names, wrong addresses, or linked accounts you didn't authorize.
- Build evidence: if a company refuses your deletion request, your data access report proves what you asked them to remove.
How to Submit a GDPR Data Access Request (Step by Step)
Step 1: Locate the data controller Open the company's privacy policy or privacy center. Look for a "Data Protection Officer" (DPO) email or "Privacy Inquiries" contact. If none is listed, email their main legal or support inbox.
Step 2: Draft your access request Write a clear, brief email:
- State: "I am exercising my right to access personal data under GDPR Article 15."
- Include your full name, email address, and any account IDs.
- Ask them to provide all personal data they hold on you in a structured, machine-readable format.
- Keep it factual — no explanation needed.
Step 3: Send and track the date Email the request directly and save a copy. The 30-day response clock starts on receipt. Most companies will reply within 1-2 weeks.
Step 4: Review and escalate if needed If you don't hear back after 30 days, file a complaint with your Data Protection Authority (AEPD, BfDI, CNIL, ICO, or your local DPA).
Tip: Large tech companies (Google, Meta, Amazon) have dedicated data access portals in their account settings. You can often download your data directly without writing an email. Check "Download Your Data," "Data & Privacy," or "Your Information" sections first.
What to Expect
Most companies send you a CSV, ZIP file, or HTML report within 2–4 weeks. The format varies, but it should include all personal data linked to your account or email address.
Related Reading
Learn what to do with your data once you have it: Exercise Your GDPR Erasure Rights →
ClaimForge
ClaimForge is a free Chrome extension that walks you through GDPR workflows, consumer claims, and EU warranty rights. Learn more: /claimforge/