Copy any template, fill in the bracketed fields, and send it to the company's privacy contact. Each template cites the applicable law. Replace [BRACKETS] with your information.
For EU, EEA, and UK residents. Companies must respond within 30 days.
Subject: Data Erasure Request Under GDPR Article 17
Dear Data Protection Officer,
I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (GDPR).
I request that you erase all personal data you hold about me, including data collected through my use of your services, data obtained from third parties, and data derived from my personal information.
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
[Account username or ID if applicable: YOUR USERNAME]
Under the GDPR, you are required to respond within 30 days of receipt. If you believe an exemption applies, please state the specific legal basis for your refusal.
If you have disclosed my data to third parties, I also request that you notify those third parties of this erasure request, as required under Article 17(2).
Sincerely,
[YOUR FULL NAME]
[DATE]
GDPR Access Request Article 15
For EU, EEA, and UK residents. Request a copy of all data the company holds about you.
Subject: Data Access Request Under GDPR Article 15
Dear Data Protection Officer,
I am writing to exercise my right of access under Article 15 of the General Data Protection Regulation (GDPR).
Please provide me with:
1. Confirmation of whether you process any personal data about me.
2. A copy of all personal data you hold about me.
3. The purposes for which my data is processed.
4. The categories of personal data held.
5. The recipients or categories of recipients to whom my data has been disclosed.
6. The retention period or criteria used to determine it.
7. The source of my data if not collected directly from me.
8. Whether you use my data for automated decision-making or profiling.
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
[Account username or ID if applicable: YOUR USERNAME]
Under the GDPR, you are required to respond within 30 days of receipt.
Sincerely,
[YOUR FULL NAME]
[DATE]
CCPA Deletion Request California
For California residents. Companies must respond within 45 days.
Subject: Request to Delete Personal Information — California Consumer Privacy Act
To Whom It May Concern,
I am a California resident exercising my right to delete under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
I request that you delete all personal information you have collected about me.
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
[Account username or ID if applicable: YOUR USERNAME]
Under the CCPA, you are required to respond within 45 days of receipt. If you believe an exemption applies, please state the specific basis for your refusal.
If you have sold or shared my personal information with third parties, I also request that you notify those third parties of this deletion request.
Sincerely,
[YOUR FULL NAME]
[DATE]
CCPA Access Request California
For California residents. Request the specific data a company has collected about you.
Subject: Request to Know — California Consumer Privacy Act
To Whom It May Concern,
I am a California resident exercising my right to know under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
I request the following information covering the 12-month period preceding this request:
1. The categories of personal information you have collected about me.
2. The specific pieces of personal information you have collected about me.
3. The categories of sources from which my information was collected.
4. The business or commercial purpose for collecting my information.
5. The categories of third parties with whom you share my information.
6. If you sell or share my information, the categories sold or shared and to whom.
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
[Account username or ID if applicable: YOUR USERNAME]
Under the CCPA, you are required to respond within 45 days of receipt.
Sincerely,
[YOUR FULL NAME]
[DATE]
CCPA Opt-Out of Sale California
Direct a company to stop selling or sharing your personal information. Must be processed within 15 business days.
Subject: Request to Opt Out of Sale or Sharing — California Consumer Privacy Act
To Whom It May Concern,
I am a California resident exercising my right to opt out of the sale and sharing of my personal information under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
I direct you to stop selling and sharing my personal information effective immediately.
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
Under the CCPA, you are required to process this request within 15 business days. You may not require me to create an account to submit this request.
Sincerely,
[YOUR FULL NAME]
[DATE]
General Request Any jurisdiction
For use when no specific privacy law applies. Polite and firm; no legal citation.
Subject: Request for Personal Data Access and Deletion
To Whom It May Concern,
I am writing to request information about the personal data your company holds about me, and to request its deletion.
I am requesting:
1. A copy of all personal data you have collected about me, including data obtained from third parties.
2. An explanation of how my data has been used and with whom it has been shared.
3. The deletion of all personal data you hold about me that is not required for legal or contractual obligations.
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
[Account username or ID if applicable: YOUR USERNAME]
If you require additional information to verify my identity, please contact me at the email address above.
Sincerely,
[YOUR FULL NAME]
[DATE]
Follow-Up — No Response All jurisdictions
When a company misses the legal deadline. Use before escalating to a regulator.
Subject: Follow-Up: Data Request — No Response Received
To Whom It May Concern,
On [DATE OF ORIGINAL REQUEST], I submitted a data [access/deletion] request to your organization. As of today, [TODAY'S DATE], I have not received a response.
Under [APPLICABLE LAW — for example "the GDPR" or "the CCPA"], you were required to respond within [DEADLINE — for example "30 days" or "45 days"]. That deadline has now passed.
I am providing you with an additional 14 days to respond to my original request. If I do not receive a substantive response by [NEW DEADLINE DATE], I will file a formal complaint with [RELEVANT REGULATOR — for example "my national Data Protection Authority" or "the California Privacy Protection Agency"].
My original request was sent to [ORIGINAL CONTACT EMAIL OR ADDRESS] on [ORIGINAL DATE].
My details:
Full name: [YOUR FULL NAME]
Email address: [YOUR EMAIL ADDRESS]
Sincerely,
[YOUR FULL NAME]
[TODAY'S DATE]