How to prepare and track a personal data rights request

What to take away

Send the request to the legal entity named in the privacy notice, not the brand on the app.
Ask for one outcome at a timeaccess, correction, deletion, restriction, objection, portability, or an opt-out.
Clocks usually start on the day the organization receives the request. One month under the GDPR, 30 days under PIPEDA, 45 days under the CCPA and CPRA.
Keep dated proof of the receipt, every identity check, any extension, and the final answer.
A late or incomplete reply goes to a regulator or a state attorney general, with an indexed package.

This is process guidance, not legal advice. Deadlines, fees and identity standards differ by state and province. Confirm the rule that applies to you.

Name the legal entity that answers

Write the legal name from the privacy notice, a receipt, the contract, or a company register. A brand, a website operator, a payment processor and an employer can be four separate parties with four separate duties.

Record the product, the account, your state or province, and how you deal with the company. If a support agent says they only process data for another business, ask who the controller is. Never send identity documents to an address you guessed.

Pick one right, then find its clock

Rights differ by jurisdiction, so read the current rule on a regulator page rather than a blog summary. California gives residents the right to know, delete, correct, and opt out of sale or sharing. PIPEDA covers access and correction for commercial records. The GDPR adds restriction, objection and portability.

The personal privacy rights guide sets out each right beside the notice text it should trigger.

The clock follows the law you invoke, not the country where you live.

Jurisdiction	Clock from receipt	Where to complain
GDPR (EU and UK)	One month, extendable by two	Data protection authority
California (CCPA and CPRA)	45 days, extendable by 45	California Privacy Protection Agency or the Attorney General
Canada (PIPEDA)	30 days, extension in writing	Office of the Privacy Commissioner
Quebec (Law 25)	30 days	Quebec access commission

The UK Information Commissioner's subject access request guidance explains what to include, and notes that the text is under review after legislative change.

The Office of the Privacy Commissioner's PIPEDA overview confirms the 30-day clock and the written extension notice.

Example: a short access request you can copy

Subject: Personal data access request, account 12345

I am [full name], a customer of [product] in [state or province]. Please give me a copy of the personal information you hold about me, and tell me the purposes, the sources, the recipients and the retention period.

Time range: 1 January 2023 to today. Format: secure download or machine-readable file.

Please confirm receipt and send a reference number.

Keep it to one page, and attach only what locates the account or shows the error you want fixed.

Drafting a short request

Subject linePersonal data access request
One-sentence lead-in of at most 15 words
List each item on its own line starting with dash
Include date, name, identifiers, right, scope
Add time range, outcome, delivery, accessibility
Ask for a receipt and reference number

Send it through the route the notice names

Use the privacy form, the privacy email or the postal address in the current notice. Check the domain before you upload anything.

Do not send documents through practical social media privacy review channels. That review covers profile visibility and inbox settings, and it explains why a chat thread is the wrong place for identity papers.

Save the completed form as a PDF before you submit it.
Keep the confirmation page or the sent email with full headers.
Log the reference number on the day it arrives.
Store one offline copy under the original filename.

Send from an address you control, so the reply lands somewhere you can search later.

Log the clock from the day of receipt

Write the receipt date as the organization reports it, not the day you wrote the letter.
Add the statutory deadline from the table above.
Record each date you sent identity evidence, a signed authorization or an answer to a question.
Save every extension notice with its stated reason and its new date.
Set a follow-up reminder for the working day after the deadline.

A clarifying question does not always pause the clock, so check the rule you are relying on. In Canada, the complaint route to the OPC or a provincial commissioner explains what a first letter must contain.

Answer identity checks on your terms

Ask why each item is needed, how it will be stored and how long it will be kept. A logged-in account or a recent transaction often satisfies a check on its own. Redact the fields the check does not need, where the organization accepts that.

Never send identity documents to a contact who reached you first by call or message.

Escalate with an indexed package

Send the organization a short list of what is missing, quoting its reference number, with only the proof that matters. Give it the chance to answer before you complain.

If the reply never comes, build one package:

A one-page summary with the reference number, the right invoked, the deadline and the outcome.
Copies of the request and every reply, in date order.
Proof of sending and proof of receipt.
The organization's privacy notice, dated.
A short table of what you asked for against what you received.

Escalation package contents