Skip to content
Pritect Veil
Get started

Tools

Letter templates

Copy one into your own system or download it as plain text. Nothing here is gated, nothing is stored and no address is asked for.

Every fact about your request is in square brackets. Replace all of them before sending, and read the letter once more afterwards.

English is the only language these letters are written in so far. A Danish, Norwegian or German version is added when there is somebody who drafts in that language to stand behind it, rather than translated here.

These are drafting starting points, not advice about the request you are holding. What a letter has to say depends on the facts of the request and on the law of the place you are answering in.

Acknowledgement

When to send it

Send it as soon as a request is recognised as one, so the person knows the period has started and who is holding it.

Relies on

What you fill in

  • [REFERENCE]
  • [NAME OF THE PERSON]
  • [DATE THE REQUEST ARRIVED]
  • [DATE THE MONTH ENDS]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: Your access request, reference [REFERENCE]

Dear [NAME OF THE PERSON],

We received your request for access to your personal data on [DATE THE REQUEST ARRIVED]. This letter confirms that we are treating it as a request under Article 15 of Regulation (EU) 2016/679.

Article 12(3) of that Regulation requires us to provide information on the action taken without undue delay and in any event within one month of receipt. On that basis we will write to you again by [DATE THE MONTH ENDS].

That period may be extended by two further months where the request is complex or where we are dealing with a number of requests. If we extend it we will tell you, with our reasons, within the first month.

Your request is recorded under reference [REFERENCE]. Please quote it in anything further you send us about it.

If you would like to tell us which information or which processing activities your request relates to, that will help us answer it well. You are not required to narrow it, and we will answer it as made if you would rather.

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.

Identity verification request

When to send it

Send it only where there is a real doubt about who made the request, and ask only for what resolves that doubt.

Relies on

What you fill in

  • [REFERENCE]
  • [NAME OF THE PERSON]
  • [DATE THE REQUEST ARRIVED]
  • [WHAT THE DOUBT IS]
  • [WHAT IS BEING ASKED FOR]
  • [WHERE TO SEND IT]
  • [DATE A REPLY IS ASKED FOR]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: Confirming your identity, reference [REFERENCE]

Dear [NAME OF THE PERSON],

Thank you for your request of [DATE THE REQUEST ARRIVED] for access to your personal data, which we have recorded under reference [REFERENCE].

Before we release the information we have to be satisfied that we are releasing it to the person it concerns. Article 12(6) of Regulation (EU) 2016/679 allows us to request the additional information necessary to confirm your identity where we have reasonable doubts about it. Our doubt in this case is [WHAT THE DOUBT IS].

To resolve it we ask you for [WHAT IS BEING ASKED FOR]. We are asking for that and nothing beyond it, we will use it only to confirm your identity, and we will not keep it once that is done.

Please send it to [WHERE TO SEND IT]. The period for answering your request runs from the day we received the request rather than from the day your identity is confirmed, so we would be grateful for a reply by [DATE A REPLY IS ASKED FOR].

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.

Scope clarification

When to send it

Send it where the volume is genuinely large and a narrower scope would produce a better answer, remembering that the person does not have to narrow anything.

Relies on

What you fill in

  • [REFERENCE]
  • [NAME OF THE PERSON]
  • [DATE THE REQUEST ARRIVED]
  • [WHAT RECORDS ARE HELD]
  • [ONE POSSIBLE SCOPE]
  • [ANOTHER POSSIBLE SCOPE]
  • [A PERIOD OF INTEREST]
  • [DATE A REPLY IS ASKED FOR]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: Your access request, reference [REFERENCE]

Dear [NAME OF THE PERSON],

We are working on your request of [DATE THE REQUEST ARRIVED], reference [REFERENCE].

We hold a large quantity of information relating to you, across [WHAT RECORDS ARE HELD]. Recital 63 of Regulation (EU) 2016/679 says that where a controller processes a large quantity of information concerning a person, it should be able to ask that person to specify the information or the processing activities the request relates to before the information is delivered.

So that our answer is useful to you rather than merely large, it would help us to know whether your request concerns [ONE POSSIBLE SCOPE], [ANOTHER POSSIBLE SCOPE], or a particular period such as [A PERIOD OF INTEREST].

You are not required to narrow your request. If you would rather we answered it as you made it, say so and we will. Article 12(1) requires our answer to be concise, intelligible and in clear and plain language whichever you choose.

The period for answering runs from the day we received your request, so we would be grateful for a reply by [DATE A REPLY IS ASKED FOR].

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.

Extension notice

When to send it

Send it inside the first month, because an extension the person was not told about in time is not one that was available.

Relies on

What you fill in

  • [REFERENCE]
  • [NAME OF THE PERSON]
  • [DATE THE REQUEST ARRIVED]
  • [THE REASON FOR THE EXTENSION]
  • [THE EXTENDED DEADLINE]
  • [NAME OF THE SUPERVISORY AUTHORITY]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: Extension of the period for answering your access request, reference [REFERENCE]

Dear [NAME OF THE PERSON],

We received your request for access to your personal data on [DATE THE REQUEST ARRIVED], reference [REFERENCE].

Article 12(3) of Regulation (EU) 2016/679 permits the period for answering to be extended by two further months where that is necessary, taking into account the complexity and the number of the requests. We are writing to you inside the first month, as that Article requires, to tell you that we are extending it and why.

Our reason is [THE REASON FOR THE EXTENSION].

We will provide our answer by [THE EXTENDED DEADLINE].

If you consider the extension unjustified, you may lodge a complaint with [NAME OF THE SUPERVISORY AUTHORITY] and you may seek a judicial remedy.

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.

Third party notification

When to send it

Send it where answering would disclose somebody else, and their view is what the decision about their rights is missing.

Relies on

What you fill in

  • [NAME OF THE OTHER PERSON]
  • [WHAT WOULD BE DISCLOSED]
  • [WHERE TO SEND A REPLY]
  • [DATE A REPLY IS ASKED FOR]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: A disclosure that would include information about you

Dear [NAME OF THE OTHER PERSON],

We have received a request for access to personal data under Article 15 of Regulation (EU) 2016/679. Answering it would involve disclosing [WHAT WOULD BE DISCLOSED], which relates to you as well as to the person who made the request.

Article 15(4) provides that the right to obtain a copy shall not adversely affect the rights and freedoms of others. Recital 63 says that the result of that consideration should not be a refusal to provide all information to the person who asked, so what we are weighing is what can be released rather than whether to answer at all.

Before we decide, we would like to know whether you object to the disclosure and, if you do, on what grounds. Please reply to [WHERE TO SEND A REPLY] by [DATE A REPLY IS ASKED FOR]. If we do not hear from you we will decide on the information we already hold.

We are not telling you who made the request, and we are not asking you to agree to anything about your own data beyond this disclosure.

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.

Refusal, manifestly unfounded or excessive

When to send it

Send it only where the request meets that test, and say what makes it meet it, because Article 12(5) puts the burden of showing it on the controller.

Relies on

What you fill in

  • [REFERENCE]
  • [NAME OF THE PERSON]
  • [DATE THE REQUEST ARRIVED]
  • [THE GROUNDS FOR THE DECISION]
  • [NAME OF THE SUPERVISORY AUTHORITY]
  • [WHAT A NARROWER REQUEST COULD COVER]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: Our decision on your access request, reference [REFERENCE]

Dear [NAME OF THE PERSON],

We received your request of [DATE THE REQUEST ARRIVED], reference [REFERENCE].

We have decided not to act on it. Article 12(5) of Regulation (EU) 2016/679 permits a controller to charge a reasonable fee or to refuse to act where a request is manifestly unfounded or excessive, in particular because of its repetitive character, and it places the burden of demonstrating that character on the controller.

The grounds on which we say your request has that character are [THE GROUNDS FOR THE DECISION].

Article 12(4) requires us to tell you this without delay and at the latest within one month of receipt, with our reasons and with the routes open to you. You may lodge a complaint with [NAME OF THE SUPERVISORY AUTHORITY], and you may seek a judicial remedy.

If you would like to make a narrower request, for example one limited to [WHAT A NARROWER REQUEST COULD COVER], we will treat it as a new request and answer it.

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.

Final response, explaining the removals

When to send it

Send it with the disclosure, so the person can tell what was taken out, on what basis, and what to do if they disagree.

Relies on

What you fill in

  • [REFERENCE]
  • [NAME OF THE PERSON]
  • [DATE THE REQUEST ARRIVED]
  • [WHAT IS ENCLOSED]
  • [WHERE THAT INFORMATION IS SET OUT]
  • [HOW THE REMOVALS ARE MARKED]
  • [WHAT THE REMOVALS CONCERN]
  • [WHERE TO SEND A REPLY]
  • [NAME OF THE SUPERVISORY AUTHORITY]
  • [NAME OF THE SENDER]
  • [ROLE OF THE SENDER]
  • [ORGANISATION]
Subject: Our answer to your access request, reference [REFERENCE]

Dear [NAME OF THE PERSON],

This is our answer to your request of [DATE THE REQUEST ARRIVED], reference [REFERENCE]. What accompanies this letter is [WHAT IS ENCLOSED].

Article 15(1) of Regulation (EU) 2016/679 requires us to tell you certain things alongside the data itself: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipient your data have been or will be disclosed to, the envisaged storage period or the criteria used to set it, your rights to rectification, erasure, restriction and objection, your right to lodge a complaint with a supervisory authority, the source of the data where we did not collect it from you, and whether there is automated decision making including profiling. That information is set out at [WHERE THAT INFORMATION IS SET OUT].

Parts of the enclosed material have been removed or replaced. Article 15(4) provides that the right to obtain a copy shall not adversely affect the rights and freedoms of others, and the passages marked [HOW THE REMOVALS ARE MARKED] were removed on that basis. They concern [WHAT THE REMOVALS CONCERN]. Recital 63 makes clear that this consideration is not a reason to refuse to provide all information, and we have released everything we considered we could release.

Where a whole document is enclosed rather than an extract, that is because the surrounding context is what makes the data intelligible. The Court of Justice has held that a copy under Article 15(3) means a faithful and intelligible reproduction of the personal data, and that providing it can require reproducing extracts, entire documents, or extracts from databases.

If you think something has been removed that should not have been, write to us at [WHERE TO SEND A REPLY]. You may also lodge a complaint with [NAME OF THE SUPERVISORY AUTHORITY], and you may seek a judicial remedy.

Yours sincerely,
[NAME OF THE SENDER]
[ROLE OF THE SENDER]
[ORGANISATION]
Download as text

Not yet reviewed

No practitioner has signed this letter off. Read it against the provision named beside it, and edit it to the request you are holding before you send it.