GDPR Letter Builder
Write a letter asking a company to show you the personal data it holds about you, or to erase it. Data about you comes with rights, and they are yours.
Information, not legal advice. This page sends nothing: you send the letter yourself.
1 What do you want?
Tip: ask to see first. Data that has already been deleted cannot be shown to you later.
Why?
A company's answer covers the data it holds when your request reaches it, and it does not have to give you data it no longer has. Data erased before you ask to see them cannot be shown to you later. Sources (open in a new tab): EDPB Guidelines 01/2022, paragraph 37.
2 Who are you writing to?
Write to the company that decides how your data are used (the controller). Its privacy notice names it. A company that only works for another may not be the right address, but calling itself a processor does not settle that.
Any channel the company provides for this is in general fine.
Look in the company's privacy notice: it must give the company's contact details, and those of its Data Protection Officer if it has one. Use an address the company gives out. A general address it gives out counts too.
Tick this if the privacy notice names a Data Protection Officer. You can contact them about your rights.
The GDPR applies to a company outside the EEA only in some cases, for example when it offers goods or services to people in the EEA or monitors their behaviour there. Local law, such as the UK's own version of the GDPR, may also apply, or apply instead.
If its privacy notice names a representative in the EU or EEA, you can write to the representative. Not every such company must have one.
3 About you
Give at least one of the two. A postal address is needed for a paper copy or a reply by post.
Why no ID card?
A company may ask for more information only when it has reasonable doubts about who you are, and only what is necessary to confirm it. Asking for a copy of an ID card is disproportionate when the company already knows it is you, for example because you are logged in, although it can be justified in some cases, for example for health data. In 2024 the Norwegian Data Protection Authority (Datatilsynet) reprimanded Norwegian Air Shuttle for always demanding ID. Sources (open in a new tab): GDPR Article 12(6); EDPB Guidelines 01/2022, paragraphs 68, 72, 73, 74 and 78; Datatilsynet, reprimand to Norwegian Air Shuttle.
4 What to ask for
Say it clearly, for example "my orders from 2024" or "the data used for marketing". A request covers everything unless you limit it clearly. Write it in the language of the letter.
Before you erase everything: erasing all your data may close your account or end a service, and you may lose records you want to keep, such as receipts or warranty details. If you only want the marketing to stop, you can limit the erasure to the data used for marketing.
What the letter asks for
- Whether they hold personal data about you, and a copy of it
- What they use it for, and what kinds of data they hold
- Who they have given it to, by name, including anyone outside the EEA
- How long they keep it, and where they got it from
- Whether they make automated decisions about you, and how those work
- The safeguards for any transfer outside the EEA
- Your other rights, and your right to complain
Most useful with employers, banks, health services and public bodies. The Court of Justice of the European Union held that this information is owed (case C-579/21). It does not give you the names of the staff who looked, unless you need them to use your rights. For patient records there is a separate right to the log with names, which this page does not cover.
The letter always asks which data they keep, if any, and why. Erasure is not absolute: a company may keep data where none of the grounds applies, or where an exception does, for example a legal duty to keep accounts.
Why these items?
Each item comes from the GDPR, as the Court of Justice of the European Union has read it. The letter names the article or the court case where that helps the company. Sources (open in a new tab): GDPR Article 15 and Article 17; Datatilsynet, right of access; Datatilsynet, right to erasure.
5 Your letter
A standard letter. Read it, change anything that is not right, and send it yourself.
The letters are fixed texts checked against the sources listed below. Nothing is written by AI while you use this page.
You have edited the letter. Changes above no longer update it.
6 Send it yourself
Your email app opens a draft with the letter, and your own email address as Cc if you gave one. Nothing is sent until you press Send there.
Keep proof of sending
- Email: keep the sent message. It shows the date and both addresses.
- Web form: take a screenshot before you submit.
- Post: keep a copy, and consider a registered letter (rekommandert brev), which gives proof of posting and of delivery.
- Always: keep a copy of the letter and proof of when you sent it. A complaint will need them.
Nothing you type is kept: reloading or closing the page empties every field.
7 Remember the deadline
This part also works on its own: fill in the company's name above and the date they received your letter.
The date they received it is estimated from this: 3 working days to a company in Norway and 10 to a company abroad, the upper ends of Posten's guideline times. If you sent it by registered letter, use the date tracking shows it was handed over.
For email and web forms, the day you sent it. If you are unsure, choose a later date. An early date makes the deadline look earlier than it is.
The reminder is a 30-minute calendar event at 12.00 on the day after the deadline, with an alert when it starts. It holds the company's name, unless you leave it out, and the deadline. It never holds your name, your contact details or your letter.
How is this counted?
The company must answer without undue delay and at the latest one month after it received your request. It may extend this by two further months, but only where necessary and only if it tells you within the first month, with its reasons. The clock starts when your request reaches them through a channel they provide; they do not need to have read it. The day it arrives is not counted, the month ends on the same date in the next month, or on the last day of a shorter month, and a deadline on a Saturday, Sunday or public holiday moves to the next working day. Only Norwegian public holidays move a deadline here; other countries' holidays are not taken into account.
The clock can pause while the company gets the information it needs to confirm who you are, or asks you to narrow down a large request, if it asked without undue delay. This page does not try to count pauses.
Sources (open in a new tab): GDPR Article 12(3) and Recital 63; EDPB Guidelines 01/2022, paragraphs 159, 160 and 161, Examples 31, 32 and 33; Regulation (EEC, Euratom) No 1182/71; the Public Holidays Act (helligdagsloven); the Act on 1 and 17 May as public holidays (lov om 1 og 17 mai som høgtidsdager); Posten.
8 If they do not answer, or not fully
What the law says in each situation, and what you can do. These are general notes, not an assessment of your case.
No answer by the deadline
What the law says. The company must give you information on what it has done within one month of receiving your request. A company that will not act must tell you why, without delay and at the latest within one month.
What you can do. If nothing has arrived, they have not told you of an extension within the first month, and they have not asked about your identity or asked you to narrow your request (which can pause the time), the deadline appears to have passed. Check the date they received it first, especially for post. You may send a short reminder with your first letter attached (step 9 writes it), or complain to Datatilsynet (step 10). Keep proof of the date it reached them.
Sources (open in a new tab): GDPR Article 12(3) and Article 12(4).
They extended the deadline
What the law says. A company may take up to two further months, but only where necessary because of the complexity and number of requests, and only if it told you within one month of receipt, with the reasons for the delay. The European Data Protection Board (EDPB) says this should not be overused, and that a large effort alone does not make a request complex. The extension does not apply to telling you that they will not act.
What you can do. Save a reminder for the extended deadline. If they gave no reasons, or told you after the first month, note that for a complaint. Step 9 writes a follow-up letter for this.
Sources (open in a new tab): GDPR Article 12(3) and Article 12(4); EDPB Guidelines 01/2022, paragraphs 157, 162 and 164.
They ask who you are, or for ID
What the law says. Only when they have reasonable doubts about who you are, and only for the additional information necessary to confirm it. A copy of an ID document is disproportionate if you are already authenticated, for example logged in, although ID can be justified in some cases, in particular for special categories of data such as health data. Parts of an ID document not needed to confirm who you are may be blacked out, unless national law requires a full copy, and a company should avoid keeping the copy after the check. The clock may pause while they check, if they asked without undue delay. In 2024 Datatilsynet reprimanded Norwegian Air Shuttle for always demanding ID.
What you can do. Reply from the email address you use with them, or through your logged-in account. If they still want ID, you can ask why it is needed, and black out what is not needed. Step 9 writes a follow-up letter for this.
Sources (open in a new tab): GDPR Article 12(6); EDPB Guidelines 01/2022, paragraphs 68, 70, 73, 76, 78, 79 and 159, Examples 13 and 31; Datatilsynet, reprimand to Norwegian Air Shuttle.
They ask you to narrow it down
What the law says. A company that holds a large quantity of data about you may ask you to say what you want. If you confirm that you want everything, they must provide it in full. The clock may pause meanwhile.
What you can do. Say what matters most to you, or confirm that you want everything.
Sources (open in a new tab): GDPR Recital 63; EDPB Guidelines 01/2022, paragraphs 35 and 159.
They answered, but not fully
What the law says. The copy must be a faithful and intelligible reproduction of your data. Recipients must be named, unless that is impossible or the request is manifestly unfounded or excessive. Information about consultations (look-ups) of your data, with their dates and purposes, is owed. For automated decisions under Article 22(1), the explanation covers the procedure and principles actually applied. If they answer in layers, you may ask for all of it at once. Article 15(4), which protects other people's rights, limits the copy, not the information listed in Article 15(1). Where that information contains other people's data or trade secrets, the company must give it to Datatilsynet or a court, which weighs the interests (case C-203/22).
What you can do. Tick off what you received against the list in your letter, then ask for the rest. Step 9 has a checklist for this and writes the follow-up letter.
Sources (open in a new tab): case C-487/21; case C-154/21; case C-579/21; case C-203/22; GDPR Article 15(4); EDPB Guidelines 01/2022, paragraphs 117, 146 and 169.
They refused
What the law says. They must give you their reasons, and tell you about complaining and going to court. "Manifestly unfounded or excessive" is read narrowly, and it is for the company to show it. Even a first access request may be refused as excessive, but only if the company demonstrates an abusive intention. In Norway, the main exceptions to access are in section 16 of the Norwegian Personal Data Act (personopplysningsloven), and a refusal under it must be in writing with a precise reference to the provision. Archive and research exceptions are in § 17, and journalism, academic, artistic and literary expression in § 3. Erasure has its own exceptions, in Article 17(3).
What you can do. Check that a reason and, for § 16, the provision are given. If they are missing, step 9 writes a follow-up letter asking for them. If you disagree with the reason, you can complain to Datatilsynet, which decides what to look into.
Sources (open in a new tab): GDPR Article 12(4), Article 12(5) and Article 17(3); EDPB Guidelines 01/2022, paragraph 175 onwards; case C-526/24; personopplysningsloven §§ 3, 16 and 17.
They want a fee
What the law says. Your request is free of charge, unless it is manifestly unfounded or excessive. The first copy is free even when your reason for asking is not one of those the GDPR gives in Recital 63. For further copies, a reasonable fee based on administrative costs may be charged.
What you can do. Point this out to them.
Sources (open in a new tab): GDPR Article 12(5) and Article 15(3); case C-307/22.
They say they are only a processor, or the wrong company
What the law says. The controller is whoever in fact decides why and how your data are used; what a contract calls them matters less. Datatilsynet fined Timegrip AS NOK 250,000 for refusing 80 employees access on the ground that it was only a processor, after the retail chain it worked for went bankrupt. The privacy notice must name the controller.
What you can do. Ask who the controller is, and write to it.
Sources (open in a new tab): Datatilsynet, fine to Timegrip AS; GDPR Article 13(1).
Erasure: they kept some data
What the law says. Erasure is not absolute. Datatilsynet writes "det er ikke en absolutt rett til å bli glemt" (it is not an absolute right to be forgotten). Data may be kept where no ground in Article 17(1) applies, or where an exception in Article 17(3) does, and they must give you their reasons.
What you can do. Check that they named the data and gave a reason. A legal duty to keep records, such as bookkeeping rules, can be a lawful reason.
Sources (open in a new tab): Datatilsynet, right to erasure; GDPR Article 17(1), Article 17(3)(b) and Article 12(4).
Erasure: done
What the law says. They must tell each recipient, unless that proves impossible or involves disproportionate effort, and tell you who the recipients are if you asked.
What you can do. Keep their confirmation.
Sources (open in a new tab): GDPR Article 19.
Not the right rules for your case
What the law says. Where a request is expressly based on other access rules instead of the GDPR, it is examined under those rules; where the GDPR applies, its right of access still applies alongside them. Party access under the Public Administration Act (forvaltningsloven) and access to public bodies' documents under the Freedom of Information Act (offentleglova) are other kinds of access. Cases handled under the court procedure acts fall outside the Personal Data Act and the GDPR, and Datatilsynet cannot help with access to criminal case documents, which the Criminal Procedure Act (straffeprosessloven) decides. Patient records carry an extra right to the log with names.
What you can do. This page covers the GDPR route and nothing else.
Sources (open in a new tab): EDPB Guidelines 01/2022, paragraphs 47 and 49; personopplysningsloven § 2; Datatilsynet, complaints; Datatilsynet, right of access.
9 Write a follow-up letter
This letter uses your answers in steps 1 to 4. If you are writing later, fill them in as they were in your first letter: nothing is kept between visits.
For email and web forms, the day you sent it. For post, a date you can show, such as the delivery date in tracking or their confirmation of receipt. The letter states this date as a fact, so leave it empty if you only have an estimate.
Nothing is missing, so there is no follow-up to write.
A fixed text, like the first letter. It asks again for what your first letter asked for, and for what the law and the EDPB's guidance expect the company to tell you. Nothing is written by AI while you use this page.
You have edited the letter. Changes above no longer update it.
Attach your first letter. The reminder says a copy is attached. An email draft cannot carry an attachment, so add it in your email app before you send.
What does a follow-up say?
Each letter refers to your first letter, says what is missing in the words of the law, and asks for it. It does not threaten a complaint or a court case, and does not set a time limit of its own. Complaints are named only where the law obliges the company to tell you about them. If you want to complain, step 10 explains how. Sources (open in a new tab): GDPR Article 12(3), Article 12(4) and Article 12(6); personopplysningsloven § 16.
10 Complaining to the Norwegian Data Protection Authority (Datatilsynet)
Checked on 12 October 2026. This page never fills in or sends Datatilsynet's form.
- Contact the company first. Your letter is that contact. Datatilsynet: "Du bør kontakte den klagen gjelder før du sender en klage til oss" (you should contact the one the complaint is about before you complain to us). If the company has a Data Protection Officer (personvernombud), Datatilsynet strongly recommends contacting them first.
- Complaint or tip. A tip can be anonymous and gets no follow-up. A complaint is about your own case.
- What to attach:
- your letter as sent, with its date;
- proof of when it reached them: the sent email showing the date and the addresses, a screenshot of the web form, or the registered letter's receipt and tracking;
- every reply from the company, with dates;
- a short description of what you asked for, when, what happened and what is missing;
- any contact with other authorities about the same matter;
- a signed power of attorney (fullmakt) if you complain for someone else;
- what you want to happen, for example access or erasure.
- How to send it. The online complaint form needs ID-porten (BankID or similar) and is in Norwegian only. Without BankID, send it by post to Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, with who you complain about, your name, phone number, email and postal address, the description and the documents.
- What to expect. Datatilsynet contacts you within one month of receiving the complaint, with the expected handling time. Many cases end with a letter reminding the company of its duties (påpeking av plikt). Datatilsynet does not deal with compensation: it "har ingen myndighet til å vurdere om et lovbrudd kan føre til erstatning" (has no authority to assess whether a breach of the law can lead to compensation). For that you go to the company or the courts, and compensation needs actual damage, not only an infringement. Your contact with Datatilsynet and the case documents may be subject to freedom of information requests.
- Appeal. You can appeal a decision (vedtak) by Datatilsynet to the Privacy Appeals Board (Personvernnemnda) within three weeks of receiving it. You send the appeal to Datatilsynet, which reconsiders and forwards it if it keeps its decision. Decisions in cross-border cases handled with other European authorities (under GDPR Article 56 and Chapter VII) cannot be appealed to the board. Since 15 September 2025 the board's contact details are those of the Norwegian Civil Affairs Authority (Statens sivilrettsforvaltning).
- Other routes. You may complain to a data protection authority in the EEA, in particular in the country where you live or work, or where the infringement happened. If the authority that handles it does not deal with your complaint, or does not tell you within three months how it is progressing or how it ended, you can take that authority to court. You can also go to court against the company directly, or ask a qualifying non-profit body (properly constituted, with public-interest aims and active in data protection) to complain for you.
- Help. Datatilsynet's guidance service (veiledningstjenesten), +47 22 39 69 00, Monday 12.00 to 14.30 and Tuesday to Friday 09.00 to 11.30. For removing information about you online, slettmeg.no gives free advice.
- Facts, not legal arguments. Datatilsynet warns that AI tools used to write complaints "viser ofte til feil eller ikke-eksisterende lovverk" (often refer to wrong or non-existent law). So describe what happened and attach the documents.
- To watch. From 2 April 2027 an EU regulation sets procedural rules for complaints about cross-border processing. For rights such as access and erasure, the request must still be made to the company before a complaint. It is not yet part of Norwegian law, so check Datatilsynet's pages after that date.
Sources (open in a new tab): Datatilsynet, complaints (in Norwegian); Datatilsynet, how to complain (in English); Datatilsynet, contact; Personvernnemnda, appeals; personopplysningsloven § 22; GDPR Article 77(1), Article 78(2), Article 79, Article 80(1) and Article 82(1); case C-300/21; case C-526/24; Regulation (EU) 2025/2518; EDPB template complaint form.
A cover note to attach: your timeline
A one-page list of what happened and when, with your attachments numbered. It sticks to facts, as Datatilsynet asks. It uses the kind of request in step 1, the company's name in step 2 and your name in step 3. Write your own notes in the language of the note.
Datatilsynet's complaint form is in Norwegian, so the note starts in Norwegian.
Rows without a date are left out.
An "Other" event needs your own note; it is left out until it has one.
Facts, not legal arguments: for example "the names of the recipients". Write it in the language of the note.
You have edited the note. Changes above no longer update it.
11 Sources and date
The letters and the notes on this page were checked against these sources on 12 October 2026. Law and guidance change, and this page is not kept in step with them. For anything important, check the current position with Datatilsynet or a lawyer.
- Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), on EUR-Lex
- The GDPR in Norwegian (personvernforordningen) and the Norwegian Personal Data Act (personopplysningsloven), on Lovdata
- EDPB Guidelines 01/2022 on the right of access, version 2.1
- EDPB coordinated enforcement report 2025 on the right to erasure
- Court of Justice of the European Union: C-154/21, C-487/21, C-579/21, C-307/22, C-300/21, C-203/22, C-526/24
- Regulation (EEC, Euratom) No 1182/71 on periods, dates and time limits, applied to the deadline by the EDPB
- The Public Holidays Act (helligdagsloven) and the Act on 1 and 17 May as public holidays (lov om 1 og 17 mai som høgtidsdager)
- Datatilsynet: right of access, right to erasure, complaints, contact
- Personvernnemnda and Posten
Stormberry AS is not connected with Datatilsynet, the EDPB or the EU, and they have not reviewed this page. The letters are our own wording and use the words of the law where precision matters; quotations elsewhere on this page are marked.
Android app: the same letters on your phone. No permissions and no internet access.
Get the Android app on Zapstore (opens in a new tab)
