A data subject request is a formal message you send to a company asking it to tell you what personal information it holds about you, give you a copy, correct mistakes, delete records, or stop using the data in certain ways. Privacy laws including the EU’s General Data Protection Regulation (GDPR) and a growing set of U.S. state statutes require companies to honor these requests, usually within a fixed deadline and at no charge. You don’t need a lawyer or a special form. You identify the company, say clearly what you want, prove you are who you claim to be, and send it.
What You Can Ask For
Before writing anything, decide which right you actually want to use. Bundling several into one vague message slows the response and muddies the legal basis. The rights most people rely on:
- Access. Ask the company to confirm it holds your data and to send you a copy, along with why it’s being processed, who it has been shared with, and how long it will be kept.1UK Legislation. Regulation EU 2016/679 – Article 15 Right of Access by the Data Subject
- Correction. If the data is wrong or incomplete, ask to have it fixed.2GDPR-info. Art. 16 GDPR – Right to Rectification
- Deletion. Sometimes called the right to be forgotten. It applies when the data is no longer needed for its original purpose, you’ve withdrawn consent, the processing was unlawful, or other specific grounds are met.3UK Legislation. Regulation EU 2016/679 – Article 17 Right to Erasure
- Restriction. Instead of full erasure, tell the company to stop actively using your data while keeping it stored. Useful when you’ve disputed accuracy and want processing paused during the investigation.4GDPR-info. Art. 18 GDPR – Right to Restriction of Processing
- Portability. Under the GDPR, ask for your data in a structured, machine-readable format so you can move it to another service.
- Objection. Object to certain uses of your data. When the objection targets direct marketing under the GDPR, the company must stop immediately, no exceptions.
- Opt out of sale or sharing. Under U.S. state privacy laws, you can direct a business to stop selling or sharing your personal information. Many sites are required to display a “Do Not Sell or Share My Personal Information” link that handles this in one click.
- Limit use of sensitive data. Several U.S. state laws let you restrict a business’s use of sensitive information such as precise geolocation or financial account details to what’s needed to provide the service you asked for.
- Automated decisions. Under the GDPR, you have the right not to be subject to a decision made entirely by automated processing, including profiling, when it produces legal or similarly significant effects. You can also ask for meaningful information about the logic behind it.5Information Commissioner’s Office. What Is the Right of Access?
Which of these you can actually use depends on the law that covers the company and you. GDPR rights follow you if the company processes data of people in the European Economic Area or the UK, wherever the company itself sits. U.S. state privacy laws apply when the business meets the thresholds set by your state’s statute.
How to File the Request
Find the Right Contact
Start with the company’s privacy policy, usually linked in the site footer. Look for a section along the lines of “Your Privacy Rights” or “How to Contact Us.” Most large companies now run a dedicated privacy portal or web form, and using it routes your request straight to the team that handles it rather than a general inbox. Under the GDPR, organizations that must appoint a Data Protection Officer are required to publish that person’s contact details. If nothing specific turns up, a written request to the company’s general address still counts.
Say Clearly What You Want
You don’t need to cite a statute. Your message should cover three things: who you are, which right you’re exercising, and enough information for the company to find your records. Something like “I’d like a copy of all personal data you hold about me, including any data shared with third parties” is fine for an access request. For deletion or correction, name the specific records or errors. Precision speeds things up.
Referencing the GDPR by name if you’re in Europe, or your state’s statute if you’re in a U.S. state with a privacy law, is optional but signals that you know what you’re asking for and tends to produce faster responses.
Verify Your Identity
The company is legally required to confirm you are who you say you are before releasing personal data. Submitting through a logged-in account usually satisfies the check on its own. Otherwise, expect to be asked for details that match the company’s records. If more is requested, the company should ask only for the minimum needed to confirm identity, not the moon.6IAPP. How to Verify Identity of Data Subjects for DSARs Under the GDPR
Keep a Copy
Save what you sent and note the date. If the deadline passes or the response is thin, you’ll need proof of when you asked and what for. Web portals and email create their own records; postal mail should go certified.
How Long the Company Has to Respond
Under the GDPR, the deadline is one calendar month from receipt. Complex requests, or a heavy load of simultaneous requests, allow an extension of up to two more months, but the company must tell you about the extension and explain it within that first month.7European Data Protection Board. How Long Do I Have To Respond To An Access Request
Most U.S. state privacy laws set the standard window at 45 calendar days, with a possible 45-day extension (90 days total) if the business notifies you. Some opt-out requests carry shorter clocks, in a few cases as tight as 15 business days.
Either way, a standard request should not cost you anything. The GDPR is explicit that communication and actions taken in response to a request must be free of charge.8GDPR-info. Art. 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
When a Company Can Lawfully Refuse
Not every request has to be granted. Under the GDPR, a company can refuse or charge a reasonable fee when a request is “manifestly unfounded or excessive,” which typically applies to repeated identical requests. The burden sits on the company to show why, not on you to show the opposite.8GDPR-info. Art. 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
Deletion has its own exceptions. A company can refuse to erase your data when it needs the data to comply with a legal obligation, exercise freedom of expression, serve public health purposes, archive in the public interest, or establish or defend legal claims.3UK Legislation. Regulation EU 2016/679 – Article 17 Right to Erasure A bank can’t wipe your transaction records at your request if financial regulations require it to keep them.
U.S. state laws include similar carve-outs: completing a transaction you asked for, detecting security incidents, legal compliance, research in the public interest. Whatever the reason, the company has to tell you it’s declining and say why.
One boundary worth knowing: asking one company to delete your data does not reach copies held by other companies it previously shared the data with. Under the GDPR, if the original company made your data public it has to take reasonable steps to notify others processing it about your erasure request, but the practical reach of that is limited.3UK Legislation. Regulation EU 2016/679 – Article 17 Right to Erasure To reach those downstream copies, you generally have to file separate requests.
If You’re Ignored or Turned Down
When the deadline passes with no answer, or when the refusal looks wrong, you can escalate. Under the GDPR, you can lodge a complaint with a supervisory authority in your country, such as the UK’s Information Commissioner’s Office or France’s CNIL. The complaint costs nothing, and the authority must inform you of the progress and outcome.9GDPR-text. Article 77 GDPR – Right to Lodge a Complaint With a Supervisory Authority
In the United States, enforcement of state privacy laws generally sits with each state’s attorney general. Most state statutes do not give individual consumers a direct right to sue a company for failing to honor a privacy request. Some state attorneys general have been active in bringing cases, and administrative fines can be significant, often ranging from a few thousand dollars to $50,000 per violation, with each affected consumer potentially counted as a separate violation.
Whether the complaint goes to a European supervisory authority or a U.S. attorney general, the strongest cases are the ones where you can show a clear request, adequate information for the company to act, and either silence or a plainly inadequate response. That is why keeping your own copy of the request and the reply matters from the start.