Privacy rights, in writing
Most people never send these letters because the wording feels like a legal exam. It is not. A valid request only has to identify you, say what you want, and name the right the law gives you. This writes it, cites the correct article, and states the deadline the company is actually bound by.
This is a template, not legal advice. It reproduces rights that exist in published law and nothing more. Whether a given company is covered, and what it may lawfully refuse, depends on your situation. Nothing you type here leaves your browser: there is no server, no analytics and no storage.
| Request | Legal basis | Deadline to answer |
|---|---|---|
| See what they hold | GDPR Article 15 | One month, extendable by two further months |
| Have it erased | GDPR Article 17 | One month, extendable by two further months |
| Deletion (California) | CCPA | 45 days, extendable by another 45 |
The GDPR deadline is set by Article 12: the controller must respond "without undue delay and in any event within one month of receipt of the request", and "that period may be extended by two further months where necessary, taking into account the complexity and number of the requests". The California Attorney General states businesses must respond within 45 calendar days and may extend by another 45 if they tell you.
Name the article. A request that says "under Article 17 of the GDPR" lands on a different desk from one that says "please delete my account". Give them enough to find you. Most refusals are really failures to match you to a record, so include the email or account number they know you by. Put the deadline in writing. Stating the date you expect an answer by turns a vague ask into a dated obligation, which is also what you would need if you later complained to a supervisory authority.
Silence is itself a breach of the deadline. In the EU and the UK you can complain to your national data protection authority, and you do not need a lawyer to do it. Keep the sent copy and the date: that is the whole evidence file.
Companies you have never heard of can hold detailed profiles on you, assembled from public records and purchased datasets. They are covered by the same rights, and they are the ones where a written request tends to produce the most surprising answer. If you are working through a list of them, send the same letter to each and keep the dates in a spreadsheet.