European UnionI want to get a copy of all data a company holds about me. What's my right?
You have the right to obtain a copy of all personal data a company holds about you under the GDPR, free of charge and within one month.
What the Law Says
The General Data Protection Regulation (GDPR) gives you a clear, enforceable right to access your personal data held by companies operating in the EU.
This is called the 'right of access' and is set out in Article 15 of the GDPR. It allows you to obtain confirmation that a company is processing your personal data, and — if so — to receive a copy of that data, along with key information about how it’s being used.
The company must provide the information in a concise, transparent, intelligible and easily accessible form, using clear and plain language. You can make the request verbally or in writing, but a written request (including email) is recommended for proof.
The company must respond without undue delay and in any event within one month of receiving your request. This deadline can be extended by two further months where requests are complex or numerous — but only if the company informs you within one month and explains why the extension is necessary.
Statutory TextThe data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data...
— Regulation (EU) 2016/679, Art. 15(1) — Right of access by the data subject
Statutory TextThe controller shall provide the information without undue delay and in any event within one month of receipt of the request.
— Regulation (EU) 2016/679, Art. 12(3) — Transparent information, communication and modalities for the exercise of the rights of the data subject
What to Do
Identify the company’s data protection officer (DPO) or privacy contact — usually listed in their privacy policy or website footer.
Send a clear, dated request (email or letter) stating: 'I am making a subject access request under Article 15 of the GDPR.' Include your full name, contact details, and any identifiers (e.g., account number) to help locate your data.
Keep a copy of your request and note the date sent — this starts the one-month clock.
If the company refuses, asks for ID, or misses the deadline, you can complain to your national data protection authority (e.g., CNIL in France, ICO in the UK pre-Brexit, or the Irish DPC for many multinationals).
Sources
Same Question, Other Jurisdictions
Germany
Canada
Australia
Ireland
Singapore
India
South Korea
UK
US-California
JapanNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.