How to file a GDPR request to a company yourself

What this is about

Europe has a law — the GDPR (the General Data Protection Regulation). This law gives you one simple right:

Any company that collects data about you must, at your request, tell you what exactly it knows about you. Where it got the data, who it shares it with, on what basis it stores it, how long it will keep it. This right is called the “right of access” — Article 15 GDPR.

Anyone living in the European Union can file such a request. No lawyer needed. No payment needed. No need to explain to the company why you want to know — the law deliberately does not require a justification.

This guide is about how to do it properly, so that you have a chance of getting a real answer rather than a brush-off.

Before you start — one mandatory rule

Set up a folder. On your computer, in the cloud, in your email client — anywhere, but a separate folder for each case with each company. Everything should go into this folder:

• your first letter to the company (with the date and time it was sent)
• their reply
• your follow-ups
• their subsequent replies
• screenshots (for example, of the privacy policy, of the cookie banner)
• any technical data you collected
• if it reaches a complaint to the regulator — a copy of the complaint and the correspondence with the regulator

Why this matters — without this folder you will not be able to: prove that you wrote and when; refer three months later to a specific phrase from their reply; assemble material for a complaint to the supervisory authority; notice that the company contradicts itself between replies.

Without a folder, don’t bother starting. This is not needless bureaucracy — it is the only thing that separates a real case from a conversation that will be forgotten in a month.

Name the folder something like GDPR_CompanyName_year-month — GDPR_2026-05. Inside, keep files with clear names: 1_my_request.eml, 2_company_reply.pdf, 3_my_follow_up.eml, and so on. A year later you will come back to this folder and remember everything at once.

And a simple practical rule: always send letters from an email address you have permanent access to. Lose access to the mailbox — lose the case.

Step 1. Decide which company you are writing to and why

Before writing — get clear on this.

Who you are writing to. It must be a specific legal entity. Not “Google”, but Google Ireland Limited. Not “Facebook”, but Meta Platforms Ireland Limited. Not “the shop round the corner”, but Company X Ltd with registration code Y. The legal entity is the addressee of the request. You can find it in the privacy policy on their site — right at the beginning, in the “Who we are” section.

Why you are writing. This is only for yourself; you don’t have to tell the company. Possible reasons:

• you noticed the company knows something odd about you (it sent you an advert for something you never discussed with anyone) — you want to understand where the data came from
• you saw trackers on the site (Facebook Pixel, Google Analytics and the like) and want to know what they do with your data
• you are a former customer and want to see what they keep about you
• you simply want to use your right and take a look

All these reasons are equally valid. There are no more “correct” reasons.

Step 2. Find the right email for the request

In the company’s privacy policy, at the very end, there is usually a contact for data protection requests:

• the address of the DPO (Data Protection Officer) — the person responsible for GDPR matters
• a general email such as privacy@, dpo@, gdpr@
• if there is nothing like that — the company’s general contact email

If no address is found at all — write to the general contact and state: “please forward this request to the person responsible for data protection”.

Step 3. Write the letter

A good GDPR letter is short and specific. No need for long emotional texts and explanations of why you want your data. The letter should contain:

1. A direct statement that you are exercising your right under Article 15 GDPR. This phrase turns the letter from a “customer question” into a formal legal request, and the company is obliged to treat it as such.
2. Who you are. First name, surname, email. If you have an account — customer number or the email it is linked to. This is needed so they can find you in their systems.
3. What exactly you are asking for — a specific list, not “everything you have”:
   • all my personal data that you process, and the purposes of processing
   • the categories of data (contact, behavioural, financial and so on)
   • the recipients or categories of recipients — with specific names, not “our partners”
   • the retention period for each category
   • the legal basis under Article 6 GDPR for each processing operation
   • whether automated decision-making or profiling is applied (Article 22 GDPR)
   • the source of the data, if not obtained directly from me
   • whether data is transferred outside the EEA and on what basis
4. The response deadline — 30 days from receipt of the request (Article 12(3) GDPR).
5. A proper closing. “Kind regards”, signature, date.

Example of a minimal letter:

Hello,

I, [First name Surname], am exercising my right of access to personal data under Article 15 GDPR.

Please provide me with:

1. All my personal data that your company processes, and the purposes of processing.
2. The categories of data processed.
3. The specific names of recipients or categories of recipients to whom my data has been or will be disclosed.
4. The retention period for each category.
5. The legal basis for processing under Article 6 GDPR for each category.
6. Whether automated decision-making or profiling under Article 22 GDPR is applied.
7. The source of the data, if not obtained from me.
8. Transfers of my data outside the EEA and the safeguards applied.

Under Article 12(3) GDPR I expect a reply within 30 days.

Kind regards, [First name Surname] [email] [date]

This is enough. Sending it in English is fine if the company is not local. Save the sent letter in your folder as the first file.

Step 4. What happens next — three scenarios

Scenario A: the company asks you to confirm your identity. This is normal and lawful — they have the right to make sure the data is requested by the actual person. The methods vary: a copy of an ID document, a reply from the linked email, a visit to the office. Be ready to do this. But do not give more than necessary: do not send a full copy of your passport — the page with your name and surname is enough, cover the rest.

Scenario B: the company answers on the merits. The best outcome. Read the reply carefully — especially compare it with what is written in the privacy policy on their site. If they say “we do not share your data with third parties”, but their own cookie policy lists Google

cd ~/work/gdpru.eu && mkdir -p content/en && cat > content/en/your-data.md «‘MDEOF’

title: “How to file a GDPR request to a company yourself” description: “A simple guide: how to use your right of access to your own data under Article 15 GDPR. No lawyer, free of charge, on your own.” date: 2026-05-30 draft: false

What this is about

Europe has a law — the GDPR (the General Data Protection Regulation). This law gives you one simple right:

Any company that collects data about you must, at your request, tell you what exactly it knows about you. Where it got the data, who it shares it with, on what basis it stores it, how long it will keep it. This right is called the “right of access” — Article 15 GDPR.

Anyone living in the European Union can file such a request. No lawyer needed. No payment needed. No need to explain to the company why you want to know — the law deliberately does not require a justification.

This guide is about how to do it properly, so that you have a chance of getting a real answer rather than a brush-off.

Before you start — one mandatory rule

Set up a folder. On your computer, in the cloud, in your email client — anywhere, but a separate folder for each case with each company. Everything should go into this folder:

• your first letter to the company (with the date and time it was sent)
• their reply
• your follow-ups
• their subsequent replies
• screenshots (for example, of the privacy policy, of the cookie banner)
• any technical data you collected
• if it reaches a complaint to the regulator — a copy of the complaint and the correspondence with the regulator

Why this matters — without this folder you will not be able to: prove that you wrote and when; refer three months later to a specific phrase from their reply; assemble material for a complaint to the supervisory authority; notice that the company contradicts itself between replies.

Without a folder, don’t bother starting. This is not needless bureaucracy — it is the only thing that separates a real case from a conversation that will be forgotten in a month.

Name the folder something like GDPR_CompanyName_year-month — GDPR_2026-05. Inside, keep files with clear names: 1_my_request.eml, 2_company_reply.pdf, 3_my_follow_up.eml, and so on. A year later you will come back to this folder and remember everything at once.

And a simple practical rule: always send letters from an email address you have permanent access to. Lose access to the mailbox — lose the case.

Step 1. Decide which company you are writing to and why

Before writing — get clear on this.

Who you are writing to. It must be a specific legal entity. Not “Google”, but Google Ireland Limited. Not “Facebook”, but Meta Platforms Ireland Limited. Not “the shop round the corner”, but Company X Ltd with registration code Y. The legal entity is the addressee of the request. You can find it in the privacy policy on their site — right at the beginning, in the “Who we are” section.

Why you are writing. This is only for yourself; you don’t have to tell the company. Possible reasons:

• you noticed the company knows something odd about you (it sent you an advert for something you never discussed with anyone) — you want to understand where the data came from
• you saw trackers on the site (Facebook Pixel, Google Analytics and the like) and want to know what they do with your data
• you are a former customer and want to see what they keep about you
• you simply want to use your right and take a look

All these reasons are equally valid. There are no more “correct” reasons.

Step 2. Find the right email for the request

In the company’s privacy policy, at the very end, there is usually a contact for data protection requests:

• the address of the DPO (Data Protection Officer) — the person responsible for GDPR matters
• a general email such as privacy@, dpo@, gdpr@
• if there is nothing like that — the company’s general contact email

If no address is found at all — write to the general contact and state: “please forward this request to the person responsible for data protection”.

Step 3. Write the letter

A good GDPR letter is short and specific. No need for long emotional texts and explanations of why you want your data. The letter should contain:

1. A direct statement that you are exercising your right under Article 15 GDPR. This phrase turns the letter from a “customer question” into a formal legal request, and the company is obliged to treat it as such.
2. Who you are. First name, surname, email. If you have an account — customer number or the email it is linked to. This is needed so they can find you in their systems.
3. What exactly you are asking for — a specific list, not “everything you have”:
   • all my personal data that you process, and the purposes of processing
   • the categories of data (contact, behavioural, financial and so on)
   • the recipients or categories of recipients — with specific names, not “our partners”
   • the retention period for each category
   • the legal basis under Article 6 GDPR for each processing operation
   • whether automated decision-making or profiling is applied (Article 22 GDPR)
   • the source of the data, if not obtained directly from me
   • whether data is transferred outside the EEA and on what basis
4. The response deadline — 30 days from receipt of the request (Article 12(3) GDPR).
5. A proper closing. “Kind regards”, signature, date.

Example of a minimal letter:

Hello,

I, [First name Surname], am exercising my right of access to personal data under Article 15 GDPR.

Please provide me with:

1. All my personal data that your company processes, and the purposes of processing.
2. The categories of data processed.
3. The specific names of recipients or categories of recipients to whom my data has been or will be disclosed.
4. The retention period for each category.
5. The legal basis for processing under Article 6 GDPR for each category.
6. Whether automated decision-making or profiling under Article 22 GDPR is applied.
7. The source of the data, if not obtained from me.
8. Transfers of my data outside the EEA and the safeguards applied.

Under Article 12(3) GDPR I expect a reply within 30 days.

Kind regards, [First name Surname] [email] [date]

This is enough. Sending it in English is fine if the company is not local. Save the sent letter in your folder as the first file.

Step 4. What happens next — three scenarios

Scenario A: the company asks you to confirm your identity. This is normal and lawful — they have the right to make sure the data is requested by the actual person. The methods vary: a copy of an ID document, a reply from the linked email, a visit to the office. Be ready to do this. But do not give more than necessary: do not send a full copy of your passport — the page with your name and surname is enough, cover the rest.

Scenario B: the company answers on the merits. The best outcome. Read the reply carefully — especially compare it with what is written in the privacy policy on their site. If they say “we do not share your data with third parties”, but their own cookie policy lists Google Analytics or Facebook Pixel — that is a contradiction, and this is where the interesting part begins (see below).

Scenario C: the company stays silent, brushes you off or sends a template. For example, “we process your data only to respond to your request, details in the policy” — this is not an answer, it is evasion. The law requires information tailored to you specifically, not a general reference to the policy. Got that — move on to Step 5.

Step 5. Follow-up — if the answer is incomplete

If the company replied, but the reply is incomplete or evasive — be sure to write a second letter. In the follow-up:

• Thank them for the reply (even if it is bad — a neutral tone works better).
• Point out specifically which questions from your original list they did not answer.
• Ask for a complete reply.
• Set a new deadline — another 30 days (or shorter, if they have already exceeded the first).
• Cite the provisions — Article 12(3) GDPR (the deadline), Article 15(1)(c) (disclosure of recipients specifically for you, not as a general category).

If you managed to collect technical data (screenshots of the cookie banner) — attach it and point to the contradictions. One or two specific facts work more strongly than general accusations. Keep saving all letters in the folder.

Step 6. If there is no answer even after the follow-up

If more than 30 days have passed since the first request (or 30 days after a follow-up that also went unanswered) — you have the right to complain to the supervisory authority. In each EU country this is the national data protection regulator.

A complaint to the supervisory authority is a right, not a threat. It can be filed free of charge, in free form (there is also a form on the regulator’s website). The complaint should contain:

• who you are
• which company you sent the request to and when
• what the company answered (or did not answer)
• which GDPR provisions, in your view, were breached
• attachments: copies of all correspondence with the company (this is what the folder was for)
• what you want from the regulator (“please require the company to answer in full”, “please investigate the processing of my data”)

Do not expect a quick result. Handling can take months. Sometimes the regulator will close the case with a template “no public interest” — this is real practice, and there is a way to respond to it too (a formal objection). But that is the next level — first go through the basic cycle.

A few things worth knowing straight away

Time is your ally. The calmer and more systematic your correspondence, the stronger your position. Don’t rush, don’t get nervous in letters, don’t insult staff. A dry business tone works ten times more effectively than emotion.

Quote their own documents. The most powerful evidence against a company is its own texts: the privacy policy, the cookie banner, a previous reply. If in one place they say one thing and in another something else, you are not arguing with your opinion — you are showing that they contradict themselves.

Screenshots with a date. If a banner or policy is visible on the site — take a screenshot where the date is visible. The site can be changed, the document updated. A dated screenshot is your proof of “this is what was there at the time of the request”.

Do not intimidate or threaten. Don’t write “I’ll sue”, “I’ll go to the press”, “you’ll regret it”. This is a weak position and often works against you. Simply demand what is due under the law. The law is stronger than emotion.

Be prepared for the fact that some companies will simply ignore you. This does not mean you did something wrong. It means the company has problems complying with the GDPR, and the regulator does not yet know about them. Every step you take is information into the system, even if you personally did not get a reply.

This is a long game. One request is one brick. Do it for yourself — you gain experience and some of your data. Want practice to change — that needs dozens of people doing the same. The more people file requests, the greater the pressure on the industry to behave decently.

What you get, even if the result is not perfect

• Knowledge. You learn how companies really work with your data. This knowledge does not fade.
• A record. Your folder holds documentation — in case something goes wrong or you want to share it.
• A habit. The second time, this takes three times less time than the first.
• A right. You are using your lawful right, and this right exists precisely because people use it.

Good luck. And remember the folder.