API tools faq
paste
Deydai

🇬🇧 GDPR - CITIZEN - ENG

Deydai
Apr 25th, 2025 (edited)
155
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.41 KB | Help | 0 0
raw download clone embed print report
  1. Hello dear data controller,
  2.  
  3. With this letter, I am sending you my request.
  4.  
  5. This is a request for transparency under the General Data Protection Regulation, including a request for access, a request for portability and other specific provisions. **Please note that it is not lawful to ask data subjects to use an internal form.**
  6. See for example UK Information Commissioner's Office, 'Subject Access Code of Practice' (June 9, 2017) p. 13; and Information Commissioner's Office, ‘Guide to the GDPR: Right to access’ (May 22, 2019), stating that “even if you have a form, you should note that a request for access is valid if submitted by any means, so you should always comply with requests you receive in a letter, standard email or verbally [...] although you may invite individuals to use a form, you should make it clear that this is not compulsory”).
  7. I request a copy of all my personal data held and/or being processed. This is both a request for access and a request for portability.
  8. '''Copies of my personal data'''
  9. ---------
  10. This request concerns all my personal data
  11. Article 20
  12. ---------
  13. For data falling under the right to data portability (RGPD Article 20), which includes all data I have provided that has been indirectly observed about me (Article 29 Working Party, Guidelines on the Right to Data Portability (WP 242)*, December 13, 2016, 8) and where the legal bases for processing include consent or contract, I would like this data:
  14. - **be sent to me in a commonly used, structured and machine-readable format** such as a CSV file. A PDF is not a machine-readable format (Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ WP260 rev.01, April 11, 2018).
  15. - accompanied by **an intelligible description of all variables.**
  16. Article 15
  17. ----------
  18. For all personal data not covered by portability, I wish to request under the right of access (RGPD, art 15):
  19. - **a copy to be sent to me in electronic format**. This includes all data derived about me, such as opinions, inferences, settings and preferences. (Note that opinions, inferences and the like are considered personal data. See Case C-434/16 *Peter Nowak v Data Protection Commissioner* [2017] ECLI:EU:C:2017:994, 34). For data for which the data controller has and which is in a machine-readable format, it must be provided to me in that form in accordance with the principles of fairness and data protection by design.
  20. If your organization considers me to be the data controller for which you process data
  21.  
  22. ----------
  23. In addition, if your company considers me to be the person responsible for processing the personal data for which your company acts as a processor, please provide me with **all the data you process on my behalf in a machine-readable format** in accordance with your obligation to respect my determination of the means and purposes of processing.
  24. '‘'Processing metadata’''
  25. ----------
  26. This request also includes the metadata to which I am entitled under the RGPD.
  27. Information on data controllers, subcontractors, sources and transfers
  28. ----------
  29. - The identity of all persons jointly responsible for processing my personal data, as well as the content of your contractual relationship with them (Article 26).
  30. - All **third parties to whom the data has been communicated**, with names and contacts in accordance with Article 15(1)(c) of the GDPR. Please note that the European data protection authorities have considered that, by default, data controllers must name recipients specifically and not “categories” of recipients. If they choose to name only categories, they must explain why this is specifically justified, indicating “the type of recipient (i.e. by reference to the activities he/she carries out), the industry, sector and sub-sector and the location of the recipients”. (Article 29 Working Party, 'Guidelines on Transparency under Regulation 2016/679' WP260 rev.01, April 11, 2018 ) Please note that in the case of any transfer of data processed on the basis of consent, it is not possible to simply name the categories of recipients without invalidating this legal basis (Article 29 Working Party, 'Guidelines on Consent under Regulation 2016/679' (WP259 rev.01, April 10, 2018) 13).
  31. - If data has not been collected, observed or inferred directly from me, please provide precise information on the source of such data, including the name and contact email of the data controller(s) in question (“from which source the personal data originates”, Article 14(2)(f) and Article 15(1)(g) of the GDPR).
  32. - Please confirm where my personal data is physically stored (including backups) and, at a minimum, **if it has left the EU at any time (if so, please also detail the legal bases and safeguards for such data transfers)**.
  33.  
  34. Information on purposes and legal basis
  35. ----------
  36. - All **the purposes of processing and the legal basis for these purposes by category of personal data**. This list must be detailed by purpose, by legal basis corresponding to these purposes, and by categories of data concerned by these purposes and bases. Note that it is not acceptable to simply provide separate lists that do not provide the correspondences between these three factors (Article 29 Working Party, ‘Guidelines on Transparency under Regulation 2016/679’ (WP260 rev.01, 11 April 2018), p. 35). The best way to display this information might be in tabular form.
  37. - and specific legitimate interest where legitimate interest is invoked (Article 14(2)(b)).
  38.  
  39. Information on automated decision-making
  40. ----------
  41. - Please confirm whether or not you make automated decisions (within the meaning of Article 22 of the GDPR). If the answer is yes, please provide meaningful information about the logic involved, as well as the significance and envisaged consequences of this processing for me in accordance with Article 15(1)(h)) of the GDPR
  42.  
  43. Information on data retention
  44. ----------
  45. - Please confirm the retention period for each category of personal data, or the criteria used to make this decision, in accordance with the retention limitation principle and in compliance with Article 15(1)(d) of the GDPR.
  46. If you do not usually handle such requests, please forward this e-mail to your Data Protection Officer. If you need advice on how to handle this request, any European data protection authority should be able to help.
  47. In accordance with the law, I expect your reply within one month of receipt of this request.
  48.  
  49. Sincerely,
  50.  
  51. <<NAME AND FIRST NAME>>
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!