How to Request Your Personal Data Under GDPR (Article 15)
Your right to access (Article 15) lets you request a complete copy of all personal data a company holds about you — for free, within 30 days. This is the foundation for understanding your data footprint and the first step before deletion or correction.
Why Request Your Data?
Before you delete data or file a complaint, you need to know what's actually being stored:
- See what's tracked: emails, phone numbers, IP logs, purchase history, browsing behavior, profile data, and inferred preferences.
- Find inaccuracies: catch misspelled names, wrong addresses, or linked accounts you didn't authorize.
- Build evidence: if a company refuses deletion, your data report proves what you asked them to remove.
How to Submit a GDPR Data Access Request (Step by Step)
Locate the data controller
Open the company's privacy policy or privacy center. Look for a Data Protection Officer (DPO) email or privacy contact. If none is listed, use their main legal or support inbox.
Draft your access request
Write a clear email stating: "I am exercising my right to access personal data under GDPR Article 15." Include your full name, email address, and any account IDs. Request all data in a structured, machine-readable format.
Send and track the date
Email the request directly and save a copy. The 30-day response clock starts on receipt. Most companies reply within 1–2 weeks.
Review and escalate if needed
If you do not hear back after 30 days, file a complaint with your Data Protection Authority: AEPD (Spain), BfDI (Germany), CNIL (France), ICO (UK).
Pro tip: Large tech companies (Google, Meta, Amazon) have dedicated data access portals in their account settings. Check "Download Your Data," "Data & Privacy," or "Your Information" sections first — often faster than sending an email.
What to Expect
Most companies send you a CSV, ZIP file, or HTML report within 2–4 weeks. The format varies, but it should include all personal data linked to your account or email address. Review it for accuracy and check for information you don't recognize.
ClaimForge: EU Consumer Rights in Your Browser
ClaimForge helps EU residents exercise GDPR rights, file consumer claims, and navigate warranty disputes. It walks you through data requests, deletion, and escalation steps.
Learn more about ClaimForge →Frequently Asked Questions
Is there a charge for requesting my personal data?
No. Under GDPR, the first copy is always free. A company can only charge for additional requests if they are clearly unfounded or excessive.
How long does it take to receive my data?
Companies have 30 days from receipt. In practice, most respond within 1–3 weeks. Complex requests can be extended by another 60 days, but the company must notify you within the initial 30 days.
What should I do with my data after I receive it?
Review it for accuracy. If you find errors, request rectification under Article 16. If you want to delete the data, submit an erasure request under Article 17.