GDPR / CCPA Data Request Generator

What this generator does

This page builds a data-subject request letter for GDPR or CCPA. You choose the law, the request type and the company, then add your identity and contact details. The page writes a plain-text letter that you can edit, copy or download. It runs in the browser. It is a template for contacting an organization, not legal advice and not a filing with a regulator.

GDPR and CCPA are different

GDPR is a European framework with rights such as access, rectification, erasure, restriction, portability and objection. CCPA and CPRA are California laws with rights to know, delete, correct and opt out of sale or sharing, among others. The menu uses one set of labels for both. That does not mean every right exists in the same form under both laws. Choose the law that actually applies and check the current official guidance.

Request types

The request-type menu includes access, deletion, rectification, restriction, portability and opt-out. Access asks for a copy of the data. Deletion asks the organization to erase it. Rectification asks for corrections. Restriction asks to limit processing. Portability asks for a machine-readable export. Opt-out asks to stop sale or sharing. The current template may not include a CCPA-specific clause for rectification, restriction or portability. Review the text and add the correct wording if needed.

Company and identity fields

Enter the company name and address, your name, email and optionally your phone, account ID and postal address. The company needs enough information to find your records, and it also needs to verify that you are the person making the request. Do not send more identity documents than necessary. A request that cannot be verified may be delayed or refused, but an excessive request for ID can itself be a privacy problem.

Deadline options

The deadline menu offers 30, 45, 15 or a custom number of days, with 30 as the default. GDPR generally uses a one-month period with limited extensions, while CCPA has its own timelines and extension rules. The menu is not a legal calculator. State a deadline that matches the law and the request type, and keep proof of when you sent the request.

Format and data categories

The advanced section lets you request a format such as JSON, CSV, PDF or XML and list categories of data. A format request is a preference; the organization may provide a different structured format if the law allows. Listing categories can help the recipient locate the right records, but it can also narrow the request. Ask for all personal data if that is what you need, and describe the categories only as examples.

Identity verification and agents

An organization may ask you to verify your identity before acting. It may also accept an authorized agent, but it can require proof of authorization. The form has an agent field and an ID field, but it does not verify anything. If you are using an agent, check the organization's process and the law's requirements. Keep copies of the authorization and the request.

Output, copy and download

The letter appears in an editable text area. Copy puts it on the clipboard, and the download button saves a text file. The page does not send the request, track the response or escalate a refusal. You choose the delivery method and keep a record. If the organization has a web form, use it as well or instead, and save the confirmation.

Legal limits and disclaimers

This template does not provide legal advice and does not create an attorney-client relationship. The code does not display a legal-advice disclaimer, so this page states it explicitly. The law, the deadlines and the exceptions depend on your residence, the organization and the data. A request can be refused or limited for legal reasons. If the matter is complex, consult a privacy lawyer or the relevant regulator.

What a request can and cannot achieve

A request can prompt an organization to disclose, correct, delete or stop selling data. It cannot force a company to keep data, guarantee a particular format or override a legal exception. It does not erase data held by other companies or backups that the law allows the organization to retain. It also does not automatically compensate you for a violation. Keep your expectations realistic and document each response.

Privacy and sensitive information

The letter contains your identity and may reveal account details. The form runs in the browser, but the downloaded file is not protected. Do not include a passport, national ID or full financial account number unless the organization has a secure process for it. Clear the form when you finish, especially on a shared computer.

Common problems

If the organization cannot find your records, add the email, account ID or address you used. If the request is refused, ask for the legal reason and the complaint route. If the deadline passes, send a follow-up and keep the record. If the template uses the wrong law, start again with the correct one. If a CCPA request needs a right that is missing, add the clause or use the organization's official form.

What not to do

Do not send the same request to every company without checking the law. Do not include unnecessary identity documents. Do not assume the 30-day default is correct in every case. Do not use a CCPA letter for a GDPR request without reviewing the rights. Do not ignore a verification request. Do not publish someone else's personal data.

Keeping a record

Save a copy of the request, the date you sent it, the delivery method and the response. If the organization asks for verification, note what you provided and when. A follow-up should refer to the original request rather than starting over. If you complain to a regulator, those records help show what happened. Do not rely on a sent folder alone; export or print the important messages.

Frequently Asked Questions