Data subject request reply templates: access, erasure and more
Answer every GDPR request within one month of receiving it, extendable by two more months if you tell the person within the first month and say why. Use short templates for each step: acknowledge, check identity if in doubt, then fulfil, extend or refuse with reasons and the right to complain.
Most data subject requests are answered in a few short emails: a receipt, sometimes a question about identity, and a final reply. The wording matters because the GDPR says what the final reply must contain, and a refusal or an extension has to follow rules. This guide gives you templates for each situation, ready to adapt.
They are starting points, not legal advice. Edit them to your facts, remove anything that does not apply, and fill in every blank in square brackets before sending.
#The rules that shape every reply
Four rules from Article 12 of the GDPR apply to all the templates below.
- One month. You must inform the person of the action taken on a request without undue delay and in any event within one month of receiving it (Article 12(3)).
- Extension. The period can be extended by two further months where necessary, considering the complexity and number of requests. You must tell the person of the extension within one month of receiving the request, together with the reasons for the delay (Article 12(3)).
- Refusal. If you do not act on a request, you must tell the person without delay and at the latest within one month, give your reasons, and mention the possibility of complaining to a supervisory authority and of seeking a judicial remedy (Article 12(4)).
- Free of charge. Information and actions are free. Only when requests are manifestly unfounded or excessive, in particular because they are repetitive, may you charge a reasonable fee based on administrative costs or refuse to act, and you carry the burden of showing it (Article 12(5)).
If the request came by electronic means, answer by electronic means unless the person asks otherwise (Article 12(3)). The deadline counts from receipt, so log the date the day the request arrives.
#Which right, which article, what to send
| Request | GDPR article | What to send |
|---|---|---|
| Access | 15 | Confirmation, a copy of the data, and the information in Article 15(1)(a) to (h) and 15(2) |
| Rectification | 16 | Confirmation that the data was corrected or completed, and notice to recipients (Article 19) |
| Erasure | 17 | Confirmation of deletion and of notice to recipients, or a reasoned refusal citing Article 17(3) |
| Restriction | 18 | Confirmation that the data is marked as restricted, and notice before the restriction is lifted |
| Portability | 20 | The data the person provided, in a structured, commonly used and machine-readable format |
| Objection | 21 | Confirmation that you stopped (always for direct marketing), or your compelling grounds |
| Not to be subject to automated decisions | 22 | Human review, a chance to give their view and a way to contest the decision |
Portability applies only when the processing is based on consent or on a contract and is carried out by automated means (Article 20(1)). Objection under Article 21(1) applies to processing based on public interest or legitimate interests, and the right to object to direct marketing has no balancing test (Article 21(2) and (3)).
#Should I check the person's identity first?
Only if you have reasonable doubts. Article 12(6) lets you request the additional information necessary to confirm identity. The EDPB's guidelines on the right of access say the request must be proportionate: if the person is already authenticated, for example logged into an account, asking for an ID copy is disproportionate, and ID copies are generally not an appropriate method. Better options are a login, a confirmation link or code sent to the contact details you already hold, or a security question.
Do not hand over personal data to the wrong person, because that is itself a breach. Ask quickly, ask for the minimum, and delete any identity document soon after checking it.
#Template 1: acknowledgement
Subject: We received your request [reference]
Dear [First name],
Thank you for your message of [date]. We received your request to [access / correct / erase / restrict / receive a copy of / object to the use of] your personal data on [date received].
We will reply no later than [date, one month after receipt]. If we need more information from you, or if your request is complex, we will let you know before that date.
Your reference is [reference]. Please quote it if you write to us again.
[Name, role, company, contact details]
The EDPB recommends confirming receipt in writing and stating when the one-month period runs from and to.
#Template 2: request for identity verification
Subject: Please confirm your identity [reference]
Dear [First name],
Before we can act on your request of [date], we need to confirm that it comes from you, so that your personal data is not given to anyone else.
Please [reply from the email address linked to your account / click the confirmation link we sent / confirm the following details: [details we already hold]]. We do not need a copy of an identity document.
Our one-month period is paused until we have what we need to confirm your identity. If we do not hear from you by [date], we will close the request, and you are welcome to send it again.
[Name, role, company, contact details]
If you decide you need an identity document, say exactly which parts you need and that the rest can be hidden. The EDPB accepts that the time limit can be suspended until you have obtained the information you need to confirm identity, provided you asked without undue delay (paragraph 159 of its guidelines). So ask only when you have genuine doubts, and ask promptly.
#Template 3: response to an access request
Article 15 lists what an access response must include. Attach the copy of the data and complete each point for this person.
Subject: Your request for access to your personal data [reference]
Dear [First name],
You asked on [date] for access to the personal data we hold about you. This letter and the attached file [file name, format] are our reply.
1. Confirmation. We [do / do not] process personal data about you.
2. A copy of your data. The attached file contains the data we hold: [categories, for example account details, order history, support messages]. We have removed information about other people.
3. Information about how we use it (Article 15(1)).
- Purposes: [purposes].
- Categories of data: [categories].
- Recipients or categories of recipients, including any outside the European Economic Area: [recipients and countries].
- Safeguards for transfers outside the EEA, where they apply: [safeguards, for example standard contractual clauses].
- How long we keep it, or how we decide: [period or criteria].
- Source of the data, if it did not come from you: [source].
- Automated decision-making or profiling, with the logic involved and its likely effects: [details, or "we do not use any"].
4. Your other rights. You can ask us to correct or erase your data, to restrict its use, or to object to it. You can complain to a supervisory authority, for example [authority and website], and seek a judicial remedy.
[Name, role, company, contact details]
Send the data by a secure channel, for example a password-protected file with the password sent separately. Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others, so redact other people's details.
#Template 4: erasure carried out
Subject: Your request to erase your data [reference]
Dear [First name],
We have erased the personal data we held about you, following your request of [date], on [date of erasure].
[We have also asked the following recipients to erase it: [recipients].]
[We kept the following data because the law requires us to keep it until [date]: [data, reason, for example invoices for accounting and tax purposes]. We will not use it for anything else and will delete it when the period ends.]
Backup copies are overwritten in the normal cycle, within [period]. We will not restore your data from a backup without deleting it again.
[Name, role, company, contact details]
Article 19 requires you to notify each recipient of the data of an erasure, unless this proves impossible or involves disproportionate effort, and to tell the person which recipients you informed if they ask. Your vendor list tells you who they are.
#Template 5: erasure refused, in whole or in part
Article 17(3) says the right to erasure does not apply to the extent that processing is necessary for:
- exercising the right of freedom of expression and information;
- complying with a legal obligation under EU or member state law, or performing a task in the public interest or in the exercise of official authority;
- public health reasons under Article 9(2)(h) and (i) and Article 9(3);
- archiving in the public interest, scientific or historical research or statistical purposes, where erasure is likely to render the objectives impossible or seriously impair them; or
- the establishment, exercise or defence of legal claims.
For a small business, the two that come up most are a legal obligation, such as keeping invoices and accounting records, and legal claims, such as an open dispute.
Subject: Your request to erase your data [reference]
Dear [First name],
We received your request of [date] to erase your personal data. We have erased [data erased]. We are unable to erase [data kept] at this time.
Why. [Reason, for example: "We are required by [law or regulation] to keep invoices for [period]" or "The data is needed to establish, exercise or defend legal claims relating to [matter]"]. This falls under Article 17(3)([letter]) of the GDPR.
What happens next. We will keep this data only for that purpose, restrict who can access it, and delete it on [date or event].
Your rights. You can complain to a supervisory authority, for example [authority and website], and you can seek a judicial remedy.
[Name, role, company, contact details]
Do not refuse because erasure is inconvenient. A refusal must rest on a ground in the GDPR, and the reply must be sent within the same one-month deadline.
#Template 6: extension notice
Subject: We need more time to answer your request [reference]
Dear [First name],
We received your request on [date]. We are not able to complete it within one month because [reason, for example: your request covers a large amount of data held in several systems / we are handling a high number of requests].
The GDPR allows us to extend the period by up to two further months. We will therefore reply by [new date, no later than three months after receipt]. We are sorry for the delay and will reply sooner if we can.
You can complain to a supervisory authority, for example [authority and website].
[Name, role, company, contact details]
Send this within the first month. Reasons must be real: the extension is for complexity and for a large number of requests, not for being busy.
#Template 7: request refused as manifestly unfounded or excessive
Use this rarely. The EDPB says these concepts are interpreted narrowly, and the burden of demonstration is yours. Consider charging a reasonable fee for a repeated request rather than refusing it.
Subject: Your request of [date] [reference]
Dear [First name],
We have considered your request of [date]. We have decided [not to act on it / to act on it only after payment of a fee of [amount], based on our administrative costs] because it is [manifestly unfounded / excessive].
Our reasons. [Specific facts: for example, "This is the [number] request for the same information since [date]; the previous replies were sent on [dates] and nothing has changed since."]. Article 12(5) of the GDPR allows this for requests that are manifestly unfounded or excessive, in particular because of their repetitive character.
Your rights. You can complain to a supervisory authority, for example [authority and website], and seek a judicial remedy.
[Name, role, company, contact details]
A repeated request is not necessarily excessive. If the person is asking again because nothing happened to the first one, you must answer it.
#What about requests from the United States?
These templates are written for the GDPR. Under California's CCPA, the periods differ: 45 days to respond to requests to know, delete or correct (extendable by 45 more days with notice), and no later than 15 business days for opt-outs of sale or sharing, according to the California Attorney General. Privacyboard's replies and templates include versions with US wording, and its request log counts the deadline that applies. For the full process, see how to respond to a data subject access request.
#FAQ
#How long do I have to reply to a GDPR data subject request?
One month from receipt, without undue delay. You can extend by two further months for complex or numerous requests, but only if you inform the person within the first month and give the reasons (Article 12(3)).
#Do I have to acknowledge a request?
The GDPR does not require a receipt, but the EDPB recommends confirming receipt in writing and stating the date the one-month period ends. It also proves you received the request and when.
#Can I refuse an erasure request?
Yes, but only where an exception in Article 17(3) applies, for example a legal obligation to keep the data or the need to defend legal claims. You must explain the reason and mention the right to complain to an authority and to seek a judicial remedy.
#Can I ask for a copy of the person's ID?
Only if you have reasonable doubts about who is asking and cannot confirm identity another way. The EDPB considers ID copies generally inappropriate, and disproportionate for someone already logged in.
#Do I have to tell my vendors about an erasure or correction?
Yes, if they received the data. Article 19 requires you to notify each recipient of a rectification, erasure or restriction, unless it is impossible or involves disproportionate effort.
#Sources
Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.