Access request (GDPR Article 15)
Request a copy of all your personal data and full details of how it is processed. Choose which Article 15(1) items the letter includes — by default, everything. Includes an .ics reminder for the one-month deadline.
Other formats:
I am Matti Meikäläinen (Katuosoite 1, 00100 Helsinki). Under Article 15 of Regulation (EU) 2016/679 (the General Data Protection Regulation), I request confirmation of whether personal data concerning me is being processed and, if so, access to that data and a copy of it.
I request a copy of all personal data concerning me (Article 15(3)). If provided electronically, I would prefer a commonly used electronic form.
I additionally request the following information under Article 15(1):
– the purposes of the processing (Art. 15(1)(a))
– the categories of personal data concerned (Art. 15(1)(b))
– the recipients or categories of recipients to whom the data have been or will be disclosed (Art. 15(1)(c))
– the storage period or the criteria used to determine it (Art. 15(1)(d))
– the source of the personal data where they were not collected from me (Art. 15(1)(g))
– transfers to third countries or international organisations and the safeguards in place (Art. 15(2))
– automated decision-making including profiling, its logic and the significance and envisaged consequences for me (Art. 15(1)(h))
I also request information about my rights (Art. 15(1)(e)) and about the right to lodge a complaint with a supervisory authority (Art. 15(1)(f)).
I expect your response no later than 21 September 2026. This is one month from receipt of this request (Article 12(3)). Should you require an extension, please inform me of it and its reasons in writing within one month — an extension is possible for up to two further months (Article 12(3)). If I do not receive an appropriate response within the deadline, or if I consider my request not to have been honoured as the law requires, I will lodge a complaint with the data protection authority competent for my place of residence (Article 77) and may seek a judicial remedy (Articles 78 and 79).
I request written confirmation of the measures taken in response to this request. Where you have disclosed my personal data onward, I request notification of any rectification, erasure or restriction of processing communicated to all recipients (Article 19).
What this letter covers
- A copy of your personal data (Art. 15(3)) in a commonly used electronic form.
- Optional disclosures: purposes (a), categories (b), recipients (c), retention (d), sources (g), third-country transfers (Art. 15(2)) and automated decision-making (h).
- Always included: information about your rights (e) and the right to lodge a complaint (f).
- The one-month response deadline (Art. 12(3)) plus complaint and judicial remedy rights.
- The recipient is filled in manually: copy the address from the service's privacy policy or from a service guide on this site.
This is a general document template, not legal advice.
Frequently asked questions
What can I get with an access request?
Confirmation of whether your data is processed, a copy of the data (Art. 15(3)), and details of the purposes, data categories, recipients, retention periods, sources and third-country transfers.
Does getting my data cost anything?
No. The copy is provided free of charge, and where the request is made electronically the information is provided in a commonly used electronic form when possible (GDPR Article 15(3)).
How quickly must they respond?
One month from receiving the request (Art. 12(3)). The generator's .ics reminder fires at the deadline — if there's still no reply, you can complain to your data protection authority.
Where is my data stored?
Nowhere. The entire letter is built in your browser — form contents never leave your device and are never stored on a server.