Data Access Requests: Getting a Copy of Your Data

What you are entitled to

The core entitlement is a copy of your personal data — information relating to you as an identifiable person. That includes obvious records (files, emails about you, CCTV footage of you, call recordings, notes) and less obvious ones (internal messages discussing you, complaint logs, automated profiling data).

Alongside the copy, the organisation must tell you the purposes of processing, the categories of data, the recipients or categories of recipients it has been disclosed to, the retention period or criteria, the source of the data where it was not collected from you, and the existence of your other rights. This supporting information is frequently forgotten in responses — and frequently valuable.

How to make the request

No form is required: a letter or email identifying yourself, stating that you are making a data access request under Article 15 of the GDPR, and describing the data you want is enough. You can ask for everything, but a focused request — naming the systems, time periods and contexts that matter — is harder to fumble and faster to answer.

Send it to the organisation's data protection contact where one is published, keep proof of sending, and date it. Our free generator produces a complete, properly framed request letter from a few answers, entirely on your device.

The one-month clock and extensions

The organisation must respond without undue delay and at latest within one month of receiving the request. Where requests are complex or numerous, it may extend by up to a further two months — but it must tell you within the first month that it is extending, and why. Silence for six weeks is not an extension; it is a breach.

Identity verification is legitimate but must be proportionate: an organisation you deal with by email cannot demand certified passports as a stalling tactic. The clock and the conduct around it are both things the Data Protection Commission examines when complaints are made.

Exemptions and other people's data

The right is strong but not absolute. Responses can lawfully withhold or redact material that identifies other people (their rights are balanced against yours), legally privileged material, and certain categories protected by the Data Protection Act 2018 — with restrictions applying in areas like ongoing investigations. Opinions about you are generally your data; the author's identity sometimes is not.

A lawful response therefore often arrives redacted. The question is whether the redactions are justified and explained — a blanket refusal or a page of black ink with no reasoning is a different matter from careful, explained withholding.

Access requests in disputes

It is entirely lawful to make an access request because you are in a dispute — with your employer, an insurer, a service provider. The motive does not invalidate the request, and courts and the DPC have been consistent that access rights do not disappear because litigation is in the air, though privilege and other exemptions still apply to particular documents.

In employment matters especially, the access request is standard preparation: the personnel file, investigation notes and internal emails often decide how strong a case really is. Our guide to GDPR in employment disputes covers this in depth.

When the response is late, empty or ignored

Escalation runs in stages: a follow-up fixing a short deadline and noting the statutory position; then a complaint to the Data Protection Commission, which can direct compliance; and, where the failure caused damage, a court action under the Data Protection Act 2018. An ignored access request is itself an infringement — and in practice, a solicitor's letter restating the request with the deadlines attached resolves a large share of standoffs without going further.

Frequently asked questions

Related pages

• Data Access Request Generator
• GDPR in employment disputes
• Complaints to the DPC
• Accessing medical records