Data Subject Access Request Form - Template Form

________,
________
Email address: ________
Telephone: ________

________,
________

Date: ________

RE: DATA SUBJECT ACCESS REQUEST

For the attention of: The Data Protection Officer / Data Controller of ________

Dear Sir/Madam,

I, ________ (the “Data Subject”), am writing to exercise my right of access to my personal data held or processed by your organisation, whether in electronic or manual (structured) form.

This request is made pursuant to Article 15 of Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), as given further effect in this jurisdiction by the Data Protection Act 2018 (together, the “Data Protection Law”).

§1. Data Subject Information

Full name: ________
Date of birth: ________
Address:
________
Any reference, account or customer number(s) held by you in respect of me: ________
Proof of address enclosed: ________
Proof of identification enclosed: ________

§2. Information Requested Pursuant to Article 15 GDPR

2.1 Confirmation as to whether or not my “personal data” (as defined in Article 4(1) GDPR) is being processed by ________ and, where it is, access to that personal data.

2.2 The purposes of the processing.

2.3 The categories of personal data concerned, specifying in particular whether the data held constitutes general personal data, special categories of personal data within the meaning of Article 9 GDPR, or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR.

2.4 The recipients or categories of recipient to whom my personal data has been or will be disclosed, including, in particular, recipients in third countries or international organisations and, where applicable, the appropriate safeguards relied upon pursuant to Article 46 GDPR.

2.5 Where possible, the envisaged period for which my personal data will be stored or, if not possible, the criteria used to determine that period. It is recalled that, pursuant to the storage limitation principle in Article 5(1)(e) GDPR, personal data should be retained for no longer than is necessary for the purposes for which it is processed.

2.6 Where the personal data has not been collected from me, any available information as to the source of that data.

2.7 The existence of any automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, where applicable, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for me.

2.8 Confirmation of the existence of, and information on how to exercise, the following rights under the Data Protection Law:

a. the right to rectification (Article 16 GDPR);
b. the right to erasure (Article 17 GDPR);
c. the right to restriction of processing (Article 18 GDPR);
d. the right to object to processing (Article 21 GDPR);
e. the right to data portability (Article 20 GDPR); and
f. the right to lodge a complaint with the Data Protection Commission.

§3. Specific Data Requested

3.1 I request a copy of all personal data concerning me held by your organisation in electronic or manual (structured filing) form, including, without limitation, correspondence, file notes, recordings, video footage (e.g. CCTV) and photographs.

3.2 In particular, and without limiting the generality of the foregoing, I request access to the following:

________

Where relevant, the period to which this request relates is: ________.

§4. Time for Compliance and Manner of Response

Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna aliqua ut enim ad minim veniam quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat duis aute irure dolor in reprehenderit voluptate velit esse cillum dolore eu fugiat nulla pariatur lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna aliqua ut enim ad minim veniam quis nostrud exercitation.

Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna aliqua ut enim ad minim veniam quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat duis aute irure dolor in reprehenderit voluptate velit esse cillum dolore eu fugiat nulla pariatur lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididunt ut labore et dolore magna aliqua ut enim ad minim.

4.3 Where this request is made by electronic means, and unless I request otherwise, please provide the information in a commonly used electronic format pursuant to Article 12(3) GDPR.

4.4 For the purpose of verifying my identity, I enclose the proof of identity and proof of address referred to in §1 above. Should you require any further information reasonably necessary to confirm my identity, please contact me promptly so that any statutory time limits are not unduly delayed.

§5. General

5.1 If you do not ordinarily deal with such requests, please pass this letter without delay to your Data Protection Officer or other appropriate person within your organisation.

5.2 If you require any further information from me, or have any queries in relation to this request, please contact me at the email address or telephone number provided above.

5.3 I reserve the right to lodge a complaint with the Data Protection Commission and to seek any remedy available to me under the Data Protection Law in the event of non-compliance with this request.

I look forward to receiving your response within the statutory timeframe.

Yours faithfully,

______________________________________

________

Date: ________

The following document is attached to the present Data Subject Access Request in order to prove the identity of the Data Subject: ________

The following document is attached to the present Data Subject Access Request in order to prove the address of the Data Subject: ________