Skip to content
Templates calendar_today Updated: 7 April 2026 schedule 2 min read

Template: Response to an Access Request

Someone is asking for access to their personal data? Use this ready-to-use template to respond correctly. Copy, fill in your details, and send.

summarize Key Takeaways
  • check_circle Always verify the requester's identity first
  • check_circle You have a maximum of one month to provide the complete overview
  • check_circle Always include a copy of your privacy policy
  • check_circle The first request must always be processed free of charge; only for repeated or excessive requests may you charge a reasonable fee

When to use this template

When you receive a request for access to personal data (an “access request” or DSAR), you must provide the requester with an overview of all personal data you hold about them.

Before you respond: always verify first whether the request is genuinely from the right person. Use our identity verification template if in doubt.

The template

Template: access request response
Dear [name], We received your request to access your personal data. Thank you for contacting us about this. Below (or in the attachment) you will find an overview of the personal data processed by us: [list of personal data, or refer to the attachment] Your data is processed by us for the purposes described in our privacy policy. We are also enclosing a copy of our privacy policy. If you have any further questions, please do not hesitate to contact us. Kind regards, [organisation name]

Checklist before sending

  • Check that you have searched all systems (CRM, email, accounting, HR, paper files)
  • Include an overview of the processed data, or as an attachment
  • Always include a copy of your privacy policy
  • State for which purposes you process the data
  • Redact data of other persons if it appears in the same file
  • Save a copy of your response in your request register

Need more context? Read our complete guide to data subject rights.

auto_awesome Do you know what data you process?

GDPRWise scans your website and maps out which personal data you collect. So you know exactly what to answer when you receive an access request.

GW
GDPRWise Editorial

This article was written by the GDPRWise team and reviewed by our privacy experts. We regularly review our content for accuracy and legal correctness.