Data Request Letter Generator

Write a subject access request or data access letter for the UK, California or Canada, see the date the reply is due and get a chaser if it is late.

Reviewed by Dany, RightSums team · Updated

Runs in your browser. Free, no sign-up.

personal-finance · Daily life · UK & US

Choose your country, the type of organisation and what you want, and the tool writes a request for your personal data that is ready to send, with no gaps to fill. It works for an employer or former employer, a bank, a landlord, a council, a shop or app, or a health provider, and suggests what to name, such as your HR file, emails that mention you, call recordings or CCTV. It then works out the reply date under the UK GDPR, California's CCPA or Canada's PIPEDA, including extensions, ID requests, weekends and bank holidays. You also get a timeline, a chaser letter, a calendar reminder and the official route to complain. Your details stay in your browser.

Accepted inputs

  • Country: United Kingdom, United States (California) or Canada (follows the site region by default)
  • UK only: England or Wales, Scotland or Northern Ireland, for bank holidays
  • Type of organisation: employer or former employer, bank or lender, landlord or letting agent, council or public body, shop or online service, health provider, other
  • Organisation name, your name, address and email
  • Account, employee or reference number (optional)
  • Date range for the data (optional)
  • What to ask for: suggested items for that type of organisation as tick boxes, plus your own words
  • Date they received the request
  • Whether they asked for ID, and the date they received it
  • UK only: dates they asked you to clarify and you answered (optional)

Outputs

  • Reply due date, moved off weekends and holidays where the rules say so
  • Latest date if they extend, and the date they must tell you by
  • California: date to confirm receipt (10 business days)
  • A dated timeline of the request
  • A ready-to-send request letter or email: copy or download as .txt
  • A chaser letter for when the deadline passes
  • The official complaint route with links (ICO, CPPA, HHS or the Privacy Commissioner of Canada)
  • A calendar reminder (.ics) for the reply date
  • Save button that keeps the dates only

How to use the Data Request Letter Generator

  1. Pick your country, the type of organisation and the items you want named, then add the organisation's name and your contact details.
  2. The tool writes a request under the UK GDPR, California's CCPA, HIPAA for California health providers, or Canada's PIPEDA, asking for all your data and the extra information the law gives you.
  3. It counts the reply date from the day they received your request: one calendar month in the UK, 45 days in California and 30 days in Canada, with the rules for extensions, ID checks and holidays.
  4. You get a timeline, a chaser letter to send if the date passes, a calendar reminder and the official place to complain, and nothing you type leaves your browser.

Frequently asked questions

How long does an organisation have to reply to a subject access request?

In the UK it is one calendar month from the day they receive it. A request received on 31 January 2027 runs to 28 February, but that is a Sunday, so the ICO's rule moves it to Monday 1 March 2027. If they extend for a complex request, the latest date is 30 April 2027.

Can my employer refuse a subject access request?

Only in narrow cases. An employer has the same duty as any other organisation: it can refuse, or charge a reasonable fee, only if the request is manifestly unfounded or excessive, and it must tell you why. The letter here can name your HR file, emails that mention you, disciplinary notes and CCTV so they are not missed.

Does the clock stop if they ask for ID?

In the UK, yes: the month starts when they receive the ID they asked for. A request received on 10 January 2027 with ID received on 20 January is due on Monday 22 February 2027. In California and Canada, the time limit still runs from the day they received the request.

How long does a California business have to answer a request to know?

45 calendar days from receipt, and it should confirm receipt within 10 business days. It can take 45 more days if it tells you within the first 45. For a request received on 31 January 2027, the reply is due on 17 March 2027 and the latest date is 1 May 2027.

What can I do if they don't reply to my request?

Send a chaser, then complain. In the UK the ICO asks you to complain within three months of your last meaningful contact with the organisation. In California you can complain to the CPPA, and in Canada to the Privacy Commissioner. The tool writes the chaser and links to each body.

Sources

The rates and rules in this tool come from:

Guides that use this tool

Related tools

  • Days Between Dates Calculator

    Count the calendar days, working days and weekend days between two dates, and see the gap in weeks and days.

  • Scam Recovery Planner

    Sent money to a scammer? Get an ordered, dated plan for the UK or US: who to call first, the official numbers, and the real deadlines for claims and disputes.

  • Complaint Route Finder

    A company won't sort out your problem? See who to complain to next in the UK or US, how long to wait, the deadline to escalate and a letter to send.