Start with the controller and the outcome
The GDPR gives people in Europe enforceable rights over personal data, not a general power to demand anything an organisation knows. The useful first question is therefore not “Can I send a GDPR request?” but “What result do I need?” You may need to see the data, correct an error, stop marketing, limit disputed use, move information to another service, delete information that no longer has a valid purpose, or challenge a decision made without meaningful human involvement. A platform content or account restriction may instead belong under the Digital Services Act user-rights route.
Find the controller: the company, public authority, employer, school, platform or other organisation that decides why and how the data is used. Its privacy notice should identify the legal entity and contact route, and may name a data protection officer. A cloud host or payment processor can hold the information without being the controller that must decide your request. Send the request to the entity responsible for the account, service or decision rather than every supplier named in a cookie banner.
Personal data is broader than a name and address. It can include an account identifier, location history, device or advertising identifiers, customer-service notes, inferred interests, recordings, photos, employment records and information used to score or classify a person. Anonymous statistics fall outside the GDPR only when a person is no longer identifiable by reasonably likely means; encryption or pseudonyms alone do not necessarily remove data from scope.
What an access request should produce
The right of access starts with confirmation of whether the controller processes personal data about you. If it does, you can request the data and information needed to understand the processing: purposes, categories, retention period or criteria, available rights, the source when data did not come from you, recipients, relevant international safeguards and meaningful information about qualifying automated decision-making.
Ask for the actual recipients when that matters, not only labels such as “business partners”. The Court of Justice has held that a person can normally obtain the specific identities of recipients to whom data has been or will be disclosed, where they can be identified. Categories can be enough when identification is impossible or the controller proves that the request is manifestly unfounded or excessive.
A copy must be faithful and intelligible. It does not automatically mean every original document, email or database table, because the legal object is the personal data. But extracts—or sometimes complete documents—must be supplied when context is essential to understand the data and exercise the right effectively. A spreadsheet of unexplained codes, a screenshot with key fields hidden or a generic privacy notice may not answer a request for the personal data itself.
Access is not the same as portability. Access reaches personal data undergoing processing and the accompanying explanation. Portability is narrower: it generally concerns data you provided that is processed automatically on the basis of consent or a contract, and it requires a structured, commonly used, machine-readable format. Use access to understand a profile or decision; use portability when you want reusable data for another service.
Correction, erasure and restriction
Rectification is the direct tool for inaccurate data. Identify the field or record, explain the error and provide proportionate evidence of the correct value. Incomplete data can sometimes be completed with a supplementary statement. If a wrong address, employment status, debt marker or identity match affects a real decision, ask the controller to record the dispute while it verifies the correction.
Erasure applies in defined situations: for example, when data is no longer needed for its original purpose, consent is withdrawn and no other legal basis remains, processing is unlawful, a valid objection succeeds, or deletion is required by law. It is not an automatic “delete everything” button. Freedom of expression, public-interest tasks, health and research safeguards, legal retention duties and the establishment or defence of legal claims can justify keeping particular data.
Restriction is useful when deletion would be premature or harmful. You can ask the controller to freeze ordinary use while it checks accuracy or weighs an objection; when processing is unlawful but you need the record preserved; or when the controller no longer needs the data but you need it for a legal claim. Restricted data is usually stored but not otherwise used except under the limited grounds in Article 18, and you should be told before the restriction is lifted.
When rectification, erasure or restriction is accepted, the controller must normally communicate the change to recipients of the data unless that is impossible or involves disproportionate effort. You can ask who those recipients were. This matters when correcting the controller alone would leave a credit agency, platform partner or service provider continuing to use the old version.
Portability, objections and automated decisions
Portability can help move playlists, account contributions, measurements or other qualifying data. Ask for a structured, commonly used, machine-readable export and, where technically feasible, direct transfer to another controller. It does not force two services to become compatible, cover every inference the company created, or override the rights of other people whose data is mixed into the export.
The right to object depends on the legal basis. If processing rests on legitimate interests or a public task, explain your particular situation; the controller must stop unless it demonstrates compelling overriding grounds or needs the data for legal claims. Direct marketing is simpler: once you object, personal data may no longer be processed for that marketing, including connected profiling. An unsubscribe link is convenient, but an explicit objection creates a clear record.
Withdrawing consent stops future processing based on that consent and should be as easy as giving it. It does not retroactively make earlier consent-based processing unlawful, and it does not stop processing supported by a different valid basis. Ask the controller to identify the legal basis if it claims that withdrawing consent changes nothing.
Article 22 protects against certain decisions based solely on automated processing that produce legal or similarly significant effects, such as a qualifying credit, insurance, recruitment or access decision. Exceptions exist for necessity to enter or perform a contract, explicit consent or authorising law, with safeguards. Where the contract or consent exceptions apply, ask for meaningful human intervention, a chance to express your view and a route to contest the result—not a person who simply repeats the machine output.
Write and send a useful request
A useful request can be short: “I am exercising my right of access under Article 15 GDPR. Please confirm whether you process personal data about me and provide a copy with the purposes, categories, source, retention period, specific recipients and relevant automated-decision information. The account is [identifier]; the period is [dates]. Please respond electronically.” Add the facts needed to locate the data and remove items that do not fit your purpose.
For deletion, correction, restriction, objection or human review, name that outcome explicitly and explain the relevant ground. “Please correct my account address from X to Y; the attached official notice shows the current address” is easier to decide than a message listing every GDPR article. A combined request is valid, but mixing unrelated demands can make the response harder to assess.
Use the controller’s published privacy or data-rights channel when practical, but the existence of a web form should not erase a clear request sent through another usable contact route. Keep the message, attachments, date, delivery proof and any case number somewhere outside the account in dispute. Do not send a passport scan by default. A controller can request additional information when it has reasonable doubts about identity, but verification should be necessary and proportionate to the risk.
Requests are normally free. A controller can charge a reasonable fee or refuse only when it can demonstrate that a request is manifestly unfounded or excessive, particularly because it is repetitive. A large request is not automatically excessive. Narrowing by account, date, product or data type can speed retrieval, but you do not have to know the controller’s internal database names to exercise a right.
Deadlines, refusals and complaints
The controller must respond without undue delay and at the latest within one month of receiving the request. For complex or numerous requests it can extend by up to two further months, but it must tell you within the first month and explain why. If it takes no action, it must give reasons and explain the right to complain to a supervisory authority and seek a judicial remedy.
Read the answer against the request. Check whether it covers every account and period, whether codes are explained, whether the purposes and legal bases make sense, whether recipients are named where possible, whether retention is concrete enough to understand and whether an automated decision received a genuinely human route. Reply once with a numbered list of omissions and a reasonable date for correction; that creates a clean record for escalation.
A GDPR complaint goes to a national data protection authority, not to the European Data Protection Board. The EDPB says you can complain to the authority where you habitually live, where you work or where the alleged infringement occurred. National forms, language requirements and evidence rules can differ. Attach the original request, proof of delivery, the response, a short chronology and the specific unresolved issue rather than forwarding an unstructured mailbox.
Court action can also be available, and Article 82 provides a route to compensation for material or non-material damage caused by an infringement. An infringement alone does not automatically prove damage or the amount; national procedure and the facts matter. For a consumer dispute alongside data issues, the EU consumer-rights guide and European Small Claims guide cover different remedies that should not be confused with a DPA complaint.
A European right that needs usable enforcement
These rights matter more as services use profiling and generative or predictive systems. When comparing a European AI service, privacy promises still need a precise controller, legal basis, retention rule, recipient list, export path and human challenge route. European jurisdiction is valuable, but nationality is not a substitute for data minimisation, security and usable rights.
The GDPR is a civic achievement because the same basic rights follow a person across a continental market and can reach organisations beyond Europe when they target or monitor people here. The next test is practical enforcement: clear interfaces, intelligible copies, interoperable exports, timely decisions and independent authorities with enough capacity. A right becomes real when an ordinary person can use it without first becoming a privacy lawyer.