Exercise your data rights · Works anywhere
Asking for access to the data an organisation holds about you
Finding out what is recorded, where it came from and who it was passed to. This letter opens the file before any other step, and it is kept as the starting point.
This page gives the shape of a letter, the words that fit and the public references attached to it. It does not tell you what to do about a particular case, and it does not replace the opinion of a qualified professional. The blanks marked in the letter are for you to fill in.
When this letter fits
- A decision about you seems to rest on information you have never seen.
- You want to know what an organisation has recorded about you, and since when.
- You are preparing a challenge and you need the document before the argument.
When it does not fit
- You already know which document you are missing: asking for a copy of a document is quicker.
- You want a specific piece of information corrected: the letter correcting a wrong entry is more direct.
- You want the data to stop being kept: that is the letter about erasure.
The letter, in full
The passages that are marked are the blanks to fill in. Paragraphs carrying a condition are written only in the case stated: the workshop does that sorting, or you do it by hand.
your town, the date
Subject: Request for access to data concerning me
Reference: your file number
Dear Sir or Madam,
I am writing to you as capacity in which the organisation knows you, and I am asking you to tell me whether any data concerning me is kept by your organisation.
If “The scope of the request” is “All the data concerning me”My request covers all the data concerning me.
If “The scope of the request” is “A precise set of data”My request covers the following data: data you are after
If such data is kept, I am asking you to send me a copy of it, together with the following: the purposes for which it is used, the categories of data concerned, the origin of any data I did not provide to you myself, the recipients or categories of recipient it has been passed to, and how long it is kept for.
If “The form you want the reply in” is “A file, electronically”I am asking you to send me that reply electronically, to the email address given at the top of this letter.
If “The form you want the reply in” is “A paper copy, by post”I am asking you to send me that reply by post, to the address given at the top of this letter.
If you consider that you cannot act on all or part of this request, I am asking you to tell me the reason in writing, together with the routes of complaint open to me.
I should be grateful for a reply before date by which you expect the reply.
This letter is being sent with proof of posting retained: it dates my request, and it is from that date that the time for replying runs.
Yours faithfully,
your first name and surname
Enclosures
- A copy of proof of identity, where the organisation has to satisfy itself that it is not handing your file to somebody else.
- The reference of your file, your contract or your account.
- Nothing else: a request for access does not have to be justified.
The questions to answer
- The capacity in which the organisation knows you
Customer, former customer, member, applicant, service user, patient. That is what makes the right file findable.
Example: former customer, contract no. 4471-C cancelled in April 2026 - The scope of the request
- All the data concerning me: The broadest request, and the simplest to word.
- A precise set of data: Quicker to deal with, and harder to bury in a mass of files.
- The data you are after If “The scope of the request” is “A precise set of data”
Name the categories: call recordings, payment history, internal notes, exchanges with a department.
Example: the call history and the customer service internal notes between January and June 2026 - The form you want the reply in
- A file, electronically: The most convenient, and dated by the message carrying it.
- A paper copy, by post: To ask for if you would rather your data were not sitting in an email inbox.
- The date by which you expect the reply
A month is the period set by most data protection regimes. Count it from the date of sending.
What to ask for, precisely
- A copy of the data, and not merely a description of it: a summary is not a copy.
- The origin of any data you did not provide yourself: that is often the most instructive answer.
- The recipients it has been passed to, because a wrong entry travels.
- The retention period, which says when the file ought to disappear.
- A written, reasoned refusal rather than silence, with the routes of complaint.
The documents to attach
- A copy of proof of identity, where the organisation has to satisfy itself that it is not handing your file to somebody else.
- The reference of your file, your contract or your account.
- Nothing else: a request for access does not have to be justified.
The deadline
A month from receipt is the period set by most data protection regimes, and a reasoned extension often exists for complex requests. What you control is the starting date: it is the date of sending, and the proof of posting is what establishes it.
After sending
- Keep the letter and the proof of posting: the date of the request counts as much as the request.
- When the reply arrives, note what is missing against what was asked for, item by item.
- An incomplete reply is followed up on the missing points alone, quoting the list you asked for.
- If the file reveals a wrong entry, the next letter is the one about correction, not another request for access.
The legal grounds
This template belongs to the universal core: it invokes no national law, so it has no legal reference to cite. Its strength lies elsewhere, in how precise the facts, the dates and the request are. If your country has a text that strengthens this step, it lives in a country module, separately and by name.