Loading page
About this tool
Write GDPR, DPDP and CCPA data requests: see your data, delete it, correct it, move it to another service, or opt out of marketing.
Exercise your privacy rights with a properly worded request. Pick the right, name the company and copy a letter that cites the law that applies to you. This page brings together 5 separate data privacy request generator pages (Data access, Data correction, Data deletion, Data portability, Marketing opt out) so you can compare them without hunting for the right one.
Open Data Privacy Request Generator on AltFTool — it loads instantly in your browser.
Choose your request at the top: Data access, Data correction, Data deletion, Data portability and 1 more. On a phone it is a drop-down list.
Fill in the data privacy request generator for that request; each of the 5 options keeps its own rules, data and defaults.
Read the result, then switch request to compare. The page link keeps your request (?v=data-access), so you can bookmark or share it.
Data access, Data correction, Data deletion and the rest sit behind one picker, so switching request takes a tap instead of a new search.
Every request keeps its own rules, numbers and defaults rather than one generic template.
The link remembers the request you picked, so a bookmark or a shared link opens straight on it.
5: Data access, Data correction, Data deletion, Data portability, Marketing opt out. Pick one at the top of the tool; the page link updates (for example ?v=data-access) so you can bookmark or share that exact view.
Under the EU and UK GDPR the controller must respond without undue delay and at the latest within one calendar month of receiving the request, per Article 12(3). That can be extended by up to two further months for complex or numerous requests, but only if the controller tells you within the first month and explains why. Under the California CCPA the business has 45 calendar days, extendable once by another 45, and must confirm receipt within 10 business days.
Under GDPR and UK GDPR Art. 12(3) the controller must act without undue delay and in any event within one calendar month of receiving the request, extendable by up to two further months where the request is complex — but it must tell you about the extension inside that first month. In California the deadline is 45 calendar days, extendable once by another 45 with notice.
No. Organisations may have legal retention duties; this tool only helps draft the request.
GDPR Article 20 gives you the right to receive personal data you provided to a controller in a structured, commonly used and machine-readable format, and to transmit it to another controller. It applies only where the processing is automated and based on consent or on a contract, and Article 20(2) adds a right to have the data sent directly from one controller to another where technically feasible.
Send a written objection citing GDPR Article 21(2). The right to object to direct marketing is absolute: there is no balancing test, no exemption and no fee, and Article 21(3) requires the controller to stop processing for that purpose as soon as it receives the objection. Keep proof of the date you sent it.