What is a personal data access request?
Privacy laws such as the GDPR, the UK GDPR and California's CCPA give people the right to ask an organisation for a copy of the personal data it holds about them. Requests come in by email, phone or in person, deadlines apply, and the organisation needs to show what it provided and why anything was held back.
This form brings that into one record. Part A captures the request: who is asking, whether for themselves, a child or as a representative, their relationship with you, whether they want everything or something specific, and the format they prefer. It also asks for the supporting information most laws expect, such as purposes, sources and recipients. Part B records how you checked identity. Part C is your response: an acknowledgement with a due date, a full copy, a copy with some information withheld, nothing found, or a refusal, plus what was sent and when. Part D covers corrections and complaints.
- Best for
- Businesses, employers, clinics, schools and charities answering access requests
- Signed by
- The person making the request, and the organisation
- You set
- Scope, format, identity check, your response, data provided, anything withheld
- Length
- About 2 pages
When to use a personal data access request
- A customer asking an online shop what data it holds
- A former employee requesting their HR file and emails about them
- A parent asking a school or club for a child's records
- A patient asking a private clinic for the data it holds beyond medical notes
- A consumer making a CCPA "right to know" request
What you fill in
17 blanks, then the name and email of each person who signs: person making the request, organisation.
1 The request
- Organisation*
- Requester's full name*
- Requester's email*
- The request is made* by the person themselves · by a parent or guardian for a child · by an authorised representative
- Whose data, if not the requester's
- Date the request was received*
- Relationship with the organisation*
- Asking for* all personal data held about me · only the data described below
- Data or period wanted (optional)
- Preferred format* electronic copy by secure download link · electronic copy by email · paper copy by post · to view in person
2 Verification
- How identity was checked*
3 The organisation's response
- Organisation's response* The request is acknowledged and will be answered by the date below · A copy of the data has been provided in full · A copy of the data has been provided, with some information withheld as explained below · No personal data about the requester was found · The request has been refused, for the reasons below
- Response due by
- What was provided
- Date the copy was sent
- Information withheld or reasons for refusal
- Privacy contact*
4 Who signs
- Person making the request signature and date · The person whose data it is, or a parent, guardian or representative acting for them.
- Organisation signature and date, job title · Someone who handles privacy requests for the organisation, such as the privacy or data protection lead.
What the personal data access request covers
- Part A: The request
- Part B: Verification
- Part C: The Organisation's response
- Part D: Questions and complaints
Using the personal data access request, step by step
1 Record the request
Enter who is asking, whether they act for someone else, their relationship with you, what they want and the format they prefer.
2 Check identity
Note how you confirmed it's really them, such as a code sent to the account email. Ask for no more than you need.
3 Give your response
Choose the outcome. If you're only acknowledging, set the due date. Otherwise list what was provided, when it was sent, and anything withheld and why.
4 Sign and keep the record
The requester signs to confirm the request and you sign to confirm your response. The signed PDF is your record.
Tips before you send it
- Note the date you received the request; deadlines usually run from then. Under the GDPR it's generally one month, and under the CCPA 45 days, with extensions in some cases.
- Search everywhere data lives: email, CRM, chat tools, call recordings, paper files and service providers.
- Remove or blur other people's information unless they have agreed to its release.
- Asking someone to narrow a very broad request is fine, but you can't make them.
- Send the copy securely, especially if it contains sensitive information.
Sign it online in minutes
- Fill in the blanks. Names, dates and amounts go straight into the agreement — the preview shows exactly where.
- Name who signs. Tick “This is me” for your own part. FileIt builds the PDF with every signature, date box on the right line, and you can check or move anything before sending.
- Send it. Each signer gets a secure link and signs from any device — no account needed. The signed PDF, with an audit trail and a Certificate of Completion, is filed in your vault and emailed to everyone.
Personal data access request: frequently asked questions
What should we send with the data?
Most laws expect more than a copy: why you use the data, where it came from, who it's shared with, how long you keep it, and whether automated decisions are made. The request on this form asks for those things, so you can answer them together.
Can we withhold anything?
Sometimes. Other people's personal data, legal advice and some other categories can be withheld or redacted, depending on the law. The form records what was withheld and why.
How long do we have to respond?
It depends on the law. The GDPR and UK GDPR generally allow one month, extendable for complex requests; the CCPA allows 45 days. The form lets you acknowledge first and set a due date.
Can someone ask for a child's data?
Yes. Choose the parent or guardian option and enter the child's name. The requester confirms they have authority to act. Older children may have their own rights, depending on the law.
Does the request have to be on this form?
No. People can usually make a request in any way. The form simply gives both sides a clear record of what was asked and how you answered.