Data subject access request (DSAR) letter

Use this letter to ask an organisation, such as an employer, app, clinic or company, for a copy of the personal data it holds about you. The right of access applies under the GDPR in the EU and the UK GDPR, and similar laws in many other countries give comparable rights.

Your letter

This is general information to help you understand your options — not legal advice. Laws change and depend on your circumstances; before you act, check with an official body, a union, a legal aid service or a lawyer. Spotted something out of date? Tell us.

Tips

Send it to the organisation's data protection officer or privacy contact if one is listed in its privacy policy.
Under the GDPR and UK GDPR, the organisation usually must respond within one month and normally cannot charge a fee, though the period can be extended for complex requests.
If you do not get a proper response, you can usually complain to the data protection authority in your country.
Be careful when using a shared email account, and think about where the reply will arrive if your privacy or safety is at risk.

Data subject access request (DSAR) letter

Your details

Your letter