GDPR Data Request Letter (Subject Access, Erasure & More)
Write a letter or email asking an organisation for a copy of your personal data, or to delete, correct, restrict or move it, or stop using it for marketing, citing the right article and showing the date they must reply by.
About this tool
Under the UK GDPR you can ask any organisation for a copy of the personal data it holds about you (a subject access request, or SAR), and ask it to correct, delete, restrict or transfer that data, or stop using it. It’s free in most cases, the request doesn’t have to use any special form or wording, and you can send it to anyone in the organisation, though its data protection officer or privacy email is best. This letter quotes the relevant article so there’s no doubt what you’re asking for.
The organisation must reply within one calendar month, which the tool works out from the date you send it; it can extend this by two more months for complex requests if it tells you why within the first month. Since February 2026 the clock pauses while it waits for proof of identity it reasonably needs, so offering ID up front avoids delay. Objections to direct marketing must always be honoured. If you get no reply, complain to the organisation first, then to the ICO. Your answers are remembered on this device.