Data rights
Data — subject access request
Request a copy of the personal data an organisation holds about you.
data.access-request8 languages30-day reply window
What it actually says.
Rendered live from invented facts: A subject access request made five weeks ago and never answered. The claimant is fictional and the figures are illustrative — your own claim produces its own numbers and its own citations.
The authority in the preview
It cites the article, not the act.
A document has to name the provision it relies on or it gets filed. These are the citations the sample evaluation put into the letter above; a real claim substitutes the ones its own regimes produced.
- Regulation (EU) 2016/679, Art. 15General Data Protection RegulationArt. 15(1)–(3)
- Regulation (EU) 2016/679, Art. 12(3)General Data Protection RegulationArt. 12(3)
Where it comes from
The laws that can produce this document.
A rule module declares the documents its evaluation can render into. These are the regimes in the current catalogue that offer this one — each with its own citations, deadlines and escalation ladder.
EEA (Norway, Iceland, Liechtenstein) — GDPR as incorporated into the EEA AgreementEEASupranational — 3 countriesRegulation (EU) 2016/679 (GDPR) as incorporated into the EEA AgreementConfidence: highEU General Data Protection RegulationEUSupranational — 30 countriesRegulation (EU) 2016/679, Arts. 15–21Confidence: highRussia — Federal Law 152-FZ on Personal DataRUNational — RussiaФедеральный закон от 27.07.2006 № 152-ФЗ «О персональных данных», ст. 14, 20, 21Confidence: mediumSwitzerland Federal Act on Data Protection (revFADP)CHNational — SwitzerlandFederal Act on Data Protection (FADP, SR 235.1), Art. 25Confidence: mediumTürkiye — Personal Data Protection Law No. 6698 (KVKK)TRNational — TürkiyeKişisel Verilerin Korunması Kanunu No. 6698, Arts. 11, 13, 14Confidence: mediumUK GDPR and Data Protection Act 2018GBNational — United KingdomUK GDPR Arts. 15–21 and Data Protection Act 2018Confidence: mediumCalifornia Consumer Privacy Act (as amended by the CPRA)US-CASub-national — United StatesCal. Civ. Code § 1798.100 et seq. (California Consumer Privacy Act, as amended by the CPRA)Confidence: highCanada Personal Information Protection and Electronic Documents ActCANational — CanadaPersonal Information Protection and Electronic Documents Act, S.C. 2000, c. 5Confidence: mediumColorado Privacy ActUS-COSub-national — United StatesColo. Rev. Stat. § 6-1-1301 et seq. (Colorado Privacy Act)Confidence: mediumConnecticut Data Privacy ActUS-CTSub-national — United StatesConn. Gen. Stat. § 42-515 et seq. (Connecticut Data Privacy Act)Confidence: mediumDelaware Personal Data Privacy ActUS-DESub-national — United StatesDel. Code tit. 6, ch. 12D (Personal Data Privacy Act)Confidence: mediumIndiana Consumer Data Protection ActUS-INSub-national — United StatesInd. Code art. 24-15 (Consumer Data Protection)Confidence: mediumIowa Consumer Data Protection ActUS-IASub-national — United StatesIowa Code ch. 715D (Consumer Data Protection)Confidence: mediumKentucky Consumer Data Protection ActUS-KYSub-national — United StatesKy. Rev. Stat. § 367.3611 et seq. (Consumer Data Protection)Confidence: mediumMaryland Online Data Privacy ActUS-MDSub-national — United StatesMd. Code, Com. Law § 14-4601 et seq. (Online Data Privacy Act)Confidence: mediumMinnesota Consumer Data Privacy ActUS-MNSub-national — United StatesMinn. Stat. ch. 325O (Consumer Data Privacy)Confidence: mediumMontana Consumer Data Privacy ActUS-MTSub-national — United StatesMont. Code Ann. § 30-14-2801 et seq. (Consumer Data Privacy Act)Confidence: mediumNebraska Data Privacy ActUS-NESub-national — United StatesNeb. Rev. Stat. § 87-1101 et seq. (Data Privacy Act)Confidence: mediumNew Hampshire Data Privacy ActUS-NHSub-national — United StatesN.H. Rev. Stat. ch. 507-H (Expectation of Privacy)Confidence: mediumNew Jersey Data Privacy ActUS-NJSub-national — United StatesN.J.S.A. 56:8-166.4 et seq. (Data Privacy Act)Confidence: mediumOregon Consumer Privacy ActUS-ORSub-national — United StatesOr. Rev. Stat. § 646A.570 et seq. (Oregon Consumer Privacy Act)Confidence: mediumQuebec — Law 25 (Act respecting the protection of personal information in the private sector)CA-QCSub-national — CanadaAct respecting the protection of personal information in the private sector, CQLR c. P-39.1 (as amended by Law 25)Confidence: mediumRhode Island Data Transparency and Privacy Protection ActUS-RISub-national — United StatesR.I. Gen. Laws § 6-48.1-1 et seq. (Data Transparency and Privacy Protection Act)Confidence: mediumTennessee Information Protection ActUS-TNSub-national — United StatesTenn. Code Ann. § 47-18-3201 et seq. (Information Protection Act)Confidence: mediumTexas Data Privacy and Security ActUS-TXSub-national — United StatesTex. Bus. & Com. Code § 541.001 et seq. (Data Privacy and Security Act)Confidence: mediumUtah Consumer Privacy ActUS-UTSub-national — United StatesUtah Code § 13-61-101 et seq. (Utah Consumer Privacy Act)Confidence: mediumVirginia Consumer Data Protection ActUS-VASub-national — United StatesVa. Code § 59.1-575 et seq. (Consumer Data Protection Act)Confidence: mediumArgentina — Ley 25.326 de Protección de los Datos PersonalesARNational — ArgentinaLey 25.326 de Protección de los Datos Personales, arts. 14, 16, 33Confidence: mediumBrazil Lei Geral de Proteção de Dados (LGPD)BRNational — BrazilLei Geral de Proteção de Dados Pessoais, Lei nº 13.709/2018, Art. 18Confidence: mediumColombia — Ley 1581 de 2012 (Habeas Data)CONational — ColombiaLey 1581 de 2012 y Decreto 1074 de 2015, arts. 14 y 15Confidence: mediumMexico — Ley Federal de Protección de Datos Personales en Posesión de los ParticularesMXNational — MexicoLey Federal de Protección de Datos Personales en Posesión de los ParticularesConfidence: mediumPeru — Ley 29733 de Protección de Datos PersonalesPENational — PeruLey 29733, Ley de Protección de Datos Personales (Peru)Confidence: lowUruguay — Ley 18.331 and the URCDPUYNational — UruguayLey 18.331 de Protección de Datos Personales y Acción de Habeas Data (Uruguay)Confidence: lowEgypt — Data Protection Law 151 of 2020 (executive regulations pending)EGNational — EgyptLaw No. 151 of 2020 on the Protection of Personal Data (Egypt)Confidence: lowGhana — Data Protection Act 2012 (Act 843)GHNational — GhanaData Protection Act, 2012 (Act 843) (Ghana)Confidence: lowKenya — Data Protection Act 2019 and the ODPCKENational — KenyaData Protection Act, No. 24 of 2019 (Kenya)Confidence: mediumMorocco — Loi 09-08 and the CNDPMANational — MoroccoLoi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnelConfidence: lowNigeria — Data Protection Act 2023 and the NDPCNGNational — NigeriaNigeria Data Protection Act 2023Confidence: mediumRwanda — Law 058/2021 on the protection of personal data and privacyRWNational — RwandaLaw No. 058/2021 relating to the protection of personal data and privacy (Rwanda)Confidence: lowSouth Africa Protection of Personal Information ActZANational — South AfricaProtection of Personal Information Act 4 of 2013, ss. 23–25Confidence: lowUganda — Data Protection and Privacy Act 2019UGNational — UgandaData Protection and Privacy Act 2019 (Uganda)Confidence: lowZambia — Data Protection Act 2021ZMNational — ZambiaData Protection Act No. 3 of 2021 (Zambia)Confidence: lowAbu Dhabi Global Market — Data Protection Regulations 2021AE-ADGMSub-national — United Arab EmiratesADGM Data Protection Regulations 2021Confidence: mediumBahrain — Personal Data Protection Law No. 30 of 2018BHNational — BahrainPersonal Data Protection Law, Law No. 30 of 2018 (Bahrain)Confidence: lowDubai International Financial Centre — DIFC Data Protection Law 2020AE-DIFCSub-national — United Arab EmiratesDIFC Data Protection Law, DIFC Law No. 5 of 2020Confidence: mediumIsrael — Protection of Privacy Law (as amended by Amendment 13)ILNational — Israelחוק הגנת הפרטיות, התשמ"א-1981 (Protection of Privacy Law, 5741-1981), ss. 13–14Confidence: mediumKuwait — CITRA Data Privacy Protection Regulation (no general statute)KWNational — KuwaitCITRA Data Privacy Protection RegulationConfidence: lowOman — Personal Data Protection Law (Royal Decree 6/2022)OMNational — OmanPersonal Data Protection Law, Royal Decree No. 6/2022 (Oman)Confidence: lowQatar — Personal Data Privacy Protection Law No. 13 of 2016QANational — QatarLaw No. 13 of 2016 concerning Personal Data Privacy ProtectionConfidence: lowSaudi Arabia — Personal Data Protection Law and Implementing RegulationsSANational — Saudi ArabiaPersonal Data Protection Law, Royal Decree M/19 of 1443H as amended by Royal Decree M/148 of 1444HConfidence: mediumUnited Arab Emirates — Federal Decree-Law 45 of 2021 (rights pending Executive Regulations)AENational — United Arab EmiratesFederal Decree-Law No. 45 of 2021 on the Protection of Personal DataConfidence: lowIndia Digital Personal Data Protection Act 2023INNational — IndiaDigital Personal Data Protection Act, 2023 (No. 22 of 2023), ss. 11–14Confidence: mediumIndonesia — Personal Data Protection Law 27/2022IDNational — IndonesiaUndang-Undang No. 27 Tahun 2022 tentang Pelindungan Data PribadiConfidence: mediumJapan Act on the Protection of Personal InformationJPNational — JapanAct on the Protection of Personal Information (Act No. 57 of 2003), Arts. 33–35Confidence: lowMalaysia — Personal Data Protection Act 2010 (as amended 2024)MYNational — MalaysiaPersonal Data Protection Act 2010 (Act 709) (Malaysia), as amended by Act A1717 of 2024Confidence: mediumChina — Personal Information Protection Law (PIPL)CNNational — China中华人民共和国个人信息保护法 (Personal Information Protection Law), Arts. 44–50, 69Confidence: mediumPhilippines — Data Privacy Act of 2012 and the National Privacy CommissionPHNational — PhilippinesRepublic Act No. 10173 — Data Privacy Act of 2012Confidence: mediumSouth Korea Personal Information Protection ActKRNational — South KoreaPersonal Information Protection Act (Act No. 10465), Arts. 35–37, 39Confidence: lowSingapore — Personal Data Protection Act 2012SGNational — SingaporePersonal Data Protection Act 2012 (Singapore), ss. 21, 22, 48OConfidence: mediumTaiwan — Personal Data Protection ActTWNational — Taiwan個人資料保護法 (Personal Data Protection Act), Arts. 3, 13, 28Confidence: mediumThailand — Personal Data Protection Act B.E. 2562THNational — ThailandPersonal Data Protection Act B.E. 2562 (2019) (Thailand), ss. 30–36, 78Confidence: mediumVietnam — Decree 13/2023 on Personal Data ProtectionVNNational — VietnamNghị định 13/2023/NĐ-CP về bảo vệ dữ liệu cá nhânConfidence: mediumAustralia Privacy Act 1988AUNational — AustraliaPrivacy Act 1988 (Cth), Australian Privacy Principles 12 and 13Confidence: mediumNew Zealand — Privacy Act 2020NZNational — New ZealandPrivacy Act 2020 (New Zealand), IPP 6, ss. 40, 92 and 123Confidence: medium
The rest of the sequence
Documents are written to be worked through in order: the opening demand, then the answer to whatever they refuse with, then the escalation. Sending the last one first usually costs you the first two.
Data — erasure requestAsk an organisation to delete the personal data it holds about you.data.erasure-request8 languages30-day reply windowData — portability requestGet your data in a machine-readable format you can take elsewhere.data.portability-request8 languages30-day reply windowData — opt out of sale or sharingDirect a business to stop selling or sharing your personal information.data.optout-sale8 languages15-day reply windowData — complaint to the supervisory authorityComplain to the data protection regulator when a request is ignored or refused.data.supervisory-complaint8 languages30-day reply window
You send it
Fill in your own facts and this letter writes itself.
The claim wizard produces this document with your figures, your citations and your deadline already in it. You still print it, sign it and post it yourself — that part is not delegable and we would not take it if it were.
Duesday is not a law firm and does not provide legal advice. This document is an editable template assembled from publicly available law. You are responsible for checking that the facts and the law stated are correct for your situation, and you send it yourself in your own name. Nothing here creates a solicitor–client or attorney–client relationship, and no outcome is promised.