How to Make a Data Access Request That Gets Answered

Frame it as what it is

Say expressly that you are making a data access request under Article 15 of the GDPR. Naming the right prevents the request being treated as ordinary correspondence, engages the statutory one-month clock, and triggers the organisation's internal SAR procedure — most have one, and the magic words route you into it.

Point at the data

You are entitled to everything, but listing what you particularly want changes results: the complaint file, the call recordings from named dates, correspondence between named people about you, the CCTV from a specific time and place. Named records are hard to overlook and harder to quietly omit — and if they are omitted, the omission is demonstrable.

Add the supporting information the law entitles you to: purposes, recipients, retention, sources. Responders forget it; requesters rarely ask; it is frequently the most revealing part.

Send it right and diarise

Use the published data protection contact where one exists, keep proof of sending, and diarise one month. If an extension notice arrives, it must come within that first month with reasons; if identity verification is demanded, it must be proportionate to how the organisation normally deals with you.

The follow-up that works

At the deadline, one firm follow-up: the request date, the statutory position, a short final period. After that, escalation — a DPC complaint for the ignored or inadequate response, and legal advice where the missing data matters to a live dispute. Our generator builds the letter for you, on your device, in about two minutes.