France: asking for access to your personal data

When this letter fits

• The organisation is established in France, or processes your data from France.
• You want a copy of your data, where it came from and the list of those it has been passed to.
• A request made through an online form went unanswered, and you want a dated trace.

When it does not fit

• The organisation is established outside the European Union and does not target people within it: the universal template fits better, and the articles cited here would not apply.
• What you are looking for is an administrative document held by a public body: the France module for requesting an administrative document opens a different right.
• You already know what is recorded and you want it erased: the request for erasure goes straight to the point.

The questions to answer

• The capacity in which the organisation knows you
  Customer, former customer, member, applicant, service user. With the file reference if you have it.
  Example: former customer, contract no. 4471-C cancelled in April 2026
• The scope of the request
  • All the data concerning me: The broadest request, and the one the text provides for by default.
  • A precise set of data: Quicker, and harder to bury under a mass of files.
• The data you are after If “The scope of the request” is “A precise set of data”
  By category: call recordings, payment history, internal notes, browsing data.
  Example: the call recordings and the customer service internal notes since January 2026
• The form you want the reply in
  • A file, electronically: The text provides for a copy in a commonly used electronic form where the request is made electronically.
  • A paper copy, by post: To ask for if you would rather your data were not sitting in an email inbox.
• The date the one-month period will have run out
  One month from receipt of the request. A two-month extension is possible for complex requests, but it has to be announced to you, with reasons, within the first month.

What to ask for, precisely

• A copy of the data, not a summary: it is the copy the text provides for.
• The origin of any data not collected from you: the answer is often the most instructive thing in the file.
• The recipients, category by category where there are many.
• The retention period, or the criteria determining it.
• The existence of automated decision-making, where a decision was taken with no human involvement.
• An extension announced with reasons within the first month, if the organisation needs one: a silent extension is not an extension.

The documents to attach

• A copy of proof of identity, if the organisation has reasonable doubts about who you are. It cannot demand this as a matter of course.
• The reference of your file, your contract or your account.
• Nothing else: a request for access does not have to give reasons.

The deadline

One month from receipt. A two-month extension is provided for complex or numerous requests, on condition that it is announced with reasons within the first month. Once the period has passed with no reply, the route open is a complaint to the supervisory authority, enclosing the letter and the proof of posting.

After sending

• Keep the letter and the proof of posting: the date of the request governs everything else.
• When the reply arrives, compare it item by item with the list you asked for, and follow up on the missing points alone.
• If the reply is missing or stays incomplete, a complaint to the supervisory authority is prepared with those same documents.
• If the file reveals a wrong entry, the next letter is the one about correction.

The legal grounds

• Règlement (UE) 2016/679, article 15, paragraphe 1
  La personne concernée a le droit d’obtenir du responsable du traitement la confirmation que des données à caractère personnel la concernant sont ou ne sont pas traitées et, lorsqu’elles le sont, l’accès à ces données ainsi qu’aux informations énumérées par l’article.
  in plain words: You can ask an organisation whether it holds data about you and, if it does, obtain a copy of it along with the information on what it does with it.
  checked on August 13, 2026
• Règlement (UE) 2016/679, article 12, paragraphe 3
  Le responsable du traitement fournit à la personne concernée des informations sur les mesures prises à la suite d’une demande formulée en application des articles 15 à 22 dans les meilleurs délais et en tout état de cause dans un délai d’un mois à compter de la réception de la demande.
  in plain words: The organisation has one month to reply, counted from the day it receives your request.
  checked on August 13, 2026
• Règlement (UE) 2016/679, article 77, paragraphe 1
  Toute personne concernée a le droit d’introduire une réclamation auprès d’une autorité de contrôle, en particulier dans l’État membre de sa résidence habituelle, de son lieu de travail ou du lieu où la violation aurait été commise.
  in plain words: If no answer comes, or if the answer does not satisfy you, you can lodge a complaint with the supervisory authority. In France that is the CNIL.
  checked on August 13, 2026
• Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés
  C’est la loi française qui met en œuvre ce règlement et qui désigne la Commission nationale de l’informatique et des libertés comme autorité de contrôle en France.
  in plain words: This is the French act that puts the European regulation into effect. It names the CNIL as the authority to complain to in France.
  checked on August 13, 2026