How to Fill Out and Submit a Data Subject Request Form

To fill out a data subject request form, choose the specific right you want to exercise (access, deletion, correction, or opt-out), enter the exact name, email, and address tied to your account with that company, complete the identity verification step, and use the free-text field to narrow the scope of what you’re asking for. Save the confirmation email the company sends back, because it marks the start of a legal response clock that runs 45 calendar days under most U.S. state privacy laws.¹

Pick the Right Request Type First

Most forms open with a menu of options. Choosing the wrong one is the fastest way to get a generic reply that doesn’t do what you needed.

Right to know (access). The company sends you a report of the personal information it holds: browsing history, purchase records, geolocation data, inferred demographic profiles used for advertising, and similar categories.¹
Right to correct. If records about you contain errors, such as a wrong address, outdated employment status, or incorrect demographic details, you can direct the business to fix them.¹
Right to delete. You can ask for permanent deletion of personal information the company collected from you. Exceptions apply when the business needs the data to complete a transaction, comply with a legal obligation, or detect fraud.¹
Right to opt out of sale or sharing. This stops the company from selling your data to third-party brokers or sharing it for cross-context targeted advertising.¹
Right to limit sensitive data use. Under California’s law, you can direct a business to use sensitive personal information (Social Security number, financial account details, precise geolocation, genetic data) only for providing the service you requested, not for profiling or advertising.¹
Right to data portability. The company provides your information in a structured, machine-readable format so you can transfer it to another service.

When you’re not sure, an access request is the safest starting point. Once you see what a company actually holds on you, you can follow up with a deletion or correction request based on what you find.

Find the Form on the Company’s Site

Companies that sell personal information are required under the CCPA to display a clear “Do Not Sell or Share My Personal Information” link.¹ That link leads to an opt-out page, and most companies place their broader data request portal in the same privacy hub. If it isn’t obvious, check the website footer for labels like “Privacy Policy,” “Your Privacy Choices,” or a small shield icon. The privacy policy itself is required to include a link to the request form or instructions for submitting one.

Some businesses bury the form behind several clicks. Searching the company name plus “data subject request” or “privacy request” in a search engine often lands you on the intake page faster than navigating the site. A handful of companies still accept requests only by email to a designated privacy address, typically something like privacy@company.com, listed in the privacy policy.

Global Privacy Control as a Shortcut for Opt-Out

If all you want is to opt out of data sales and targeted advertising, you may not need a form at all. Global Privacy Control is a browser setting that automatically sends an opt-out signal to every site you visit. Under the CCPA, businesses must treat a GPC signal as a legally valid consumer request to opt out of the sale or sharing of data.² You can enable it through supported browsers like Firefox and Brave or through browser extensions. The signal covers opt-out only; access, deletion, and correction still require a form.

Complete the Identity and Scope Fields

The form itself is short, but small mistakes in the identity fields cause most delays. Companies match requests to accounts, so provide the exact name, email address, and physical address you used when you signed up or interacted with the service. If you’ve changed emails or moved since then, include both the old and current information.

After you submit those fields, expect a verification step. The company has to confirm you are who you say you are before handing over anyone’s data. Two methods are common: an emailed verification code sent to the address on file (usually with a 24 to 72 hour window to respond) or an upload of a government-issued ID like a driver’s license or passport. When companies ask for ID, they typically focus on the name and photo for matching and will redact sensitive numbers.

Most forms include a free-text field for context. Use it. Specify the exact data categories you want, or explain what’s wrong with the records if you’re asking for a correction. A note like “I want all browsing and purchase history collected between January 2023 and December 2025” narrows the scope and reduces the odds of a vague reply. For deletion, clarify whether you want everything removed or only certain categories.

Submitting on Behalf of Someone Else

You can file a request as an authorized agent for another person. Under the CCPA, the business can require the agent to provide signed permission from the consumer and may contact the consumer directly to confirm they authorized the request.¹ A power of attorney covering privacy matters will satisfy most companies. The business cannot charge extra fees for the additional verification involved.

Requests for Children Under 13

Under the federal Children’s Online Privacy Protection Rule, operators of websites and online services directed at children must give parents the chance to review the personal information collected from their child, refuse further collection, and direct the operator to delete the child’s data.³ The operator must verify that the requester is actually the child’s parent and cannot make the process unreasonably difficult.

Health Records and Credit Reports Use Different Forms

Two categories of personal data don’t go through a company’s general privacy portal. Medical records fall under the HIPAA Privacy Rule, which gives you the right to access your health information from any covered entity within 30 calendar days, extendable by another 30 with a written explanation.⁴ Providers usually have their own forms at the front desk or in a patient portal. Credit data falls under the Fair Credit Reporting Act, which entitles you to a free file disclosure every 12 months from each nationwide credit bureau, along with additional free reports after an adverse action, identity theft, or certain unemployment situations.⁵ Those requests go through AnnualCreditReport.com for the three major bureaus.

What Happens After You Submit

Most companies send an automated confirmation email with a tracking number or reference code within minutes. Save it. That timestamp proves when the legal clock started. Under the CCPA, businesses have 45 calendar days from receipt to fulfill an access, deletion, or correction request. If the request is unusually complex, the company can extend the deadline by another 45 days (90 total), but it has to notify you of the extension within the original 45-day window. Opt-out requests move faster: businesses must act within 15 business days.¹

Virginia, Colorado, and most other state privacy laws use the same 45-day baseline with a possible 45-day extension.⁶ Under the GDPR, the deadline is one month from receipt, with possible extensions in complex cases.⁷

When processing finishes, you’ll usually get a secure download link by email. Access-request files commonly arrive in JSON or CSV format, which you can open in a spreadsheet application. Some companies include a more readable PDF summary alongside the raw data. Deletion confirmations are simpler: a brief email stating what was removed and any categories retained under a legal exception.

If the Company Ignores or Denies Your Request

A company that misses the deadline faces real consequences. California’s privacy regime allows civil penalties per violation, with higher amounts for intentional violations or those involving consumers the business knows are under 16; those figures are adjusted annually for inflation.⁸ If a data breach results from a company’s failure to maintain reasonable security, consumers can also pursue a private lawsuit for statutory damages of up to $750 per incident.¹

A denial has to come in writing with the legal basis for the refusal. Appeal through the company’s internal process first. If that goes nowhere, file a complaint with the California Privacy Protection Agency for CCPA issues, or with your state attorney general if your state has its own privacy law.⁹ For GDPR matters, complaints go to the relevant data protection authority in the EU member state where the company operates. Regulators won’t intervene in every case, but a pattern of complaints against the same business tends to trigger an investigation.

1
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
2
Global Privacy Control. Global Privacy Control
3
eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule
4
U.S. Department of Health & Human Services. How Timely Must a Covered Entity Be in Responding
5
LexisNexis Risk Solutions. Your FCRA Rights
6
Virginia Code Commission. Virginia Code 59.1-577 – Personal Data Rights; Consumers
7
GDPR-info.eu. Right of Access – General Data Protection Regulation (GDPR)
8
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases
9
California Privacy Protection Agency. California Privacy Protection Agency Complaint Form