Ask for your data and the reasons, in writing.

What the law says, and the deadlines

EU / EEA: GDPR

Art. 15 gives you a copy of your data and information about the processing, including any automated decision-making and “meaningful information about the logic involved”. Art. 22 protects you from decisions based solely on automated processing that significantly affect you. Under Art. 12(3) the company must reply within one month of receipt; it can extend by two further months only if it tells you why within the first month. For online platforms, the Digital Services Act also requires a statement of reasons (Art. 17) and a free internal complaint system open for at least six months after the decision (Art. 20).

United Kingdom: UK GDPR

Since the Data (Use and Access) Act 2025, the UK time limit sits in Art. 12A: one month from the latest of receipt, receipt of any identity information asked for, or payment of a fee, extendable by two months with notice and reasons in the first month. If the company reasonably needs more details to find your data, the clock stops from the day it asks until the day you answer (Art. 12A(5)). Since 5 February 2026, automated decisions are covered by Arts 22A–22C, which replaced Art. 22 in the UK, and you can complain to the company under s. 164A of the Data Protection Act 2018 before going to the ICO.

California: CCPA / CPRA

You can ask what personal information a business collected, where from, why, and who it was shared with, plus the specific pieces (Civ. Code § 1798.110). The business must confirm receipt within 10 business days and respond within 45 calendar days of receipt, however long verification takes. It may extend once by 45 days (90 in total) if it tells you why within the first 45 days. You can ask for information collected since 1 January 2022, unless that proves impossible or would take disproportionate effort. The CCPA does not give a right to reasons for an account decision, so the letter asks for them as a request.

Sources

1. EUR-Lex: Regulation (EU) 2016/679 (GDPR), Art. 12(3)–(6). “without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.” Information is free of charge (12(5)); identity checks only where there is reasonable doubt (12(6)). Checked 25 Oct 2026.
2. EUR-Lex: GDPR, Art. 15 (right of access by the data subject). Access to the personal data and to the purposes, categories, recipients, retention period, rights, the right to complain to a supervisory authority, the source, and (h) “the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and … meaningful information about the logic involved, as well as the significance and the envisaged consequences”. Art. 15(3): a copy of the data, in a commonly used electronic form if the request was made electronically. Checked 25 Oct 2026.
3. EUR-Lex: GDPR, Art. 22 (automated individual decision-making, including profiling). The right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you. Where the decision rests on a contract or consent, at least the right to obtain human intervention, to express your point of view and to contest the decision (22(3)). Checked 25 Oct 2026.
4. EUR-Lex: Regulation (EU) 2022/2065 (Digital Services Act), Arts 17 and 20. Art. 17: a clear and specific statement of reasons for suspending or terminating an account, including the facts, any use of automated means, the contractual ground and the redress available. Art. 20: online platforms must give access, for at least six months after the decision, to an electronic, free internal complaint-handling system, and reverse the decision without undue delay where a complaint shows it was unfounded. Checked 25 Oct 2026.
5. legislation.gov.uk: UK GDPR, Art. 12 (as amended). Act on a request “without undue delay and in any event before the end of the applicable time period (see Article 12A)”. A refusal must give reasons and explain the right to complain to the controller, to the Commissioner and to seek a judicial remedy (12(4)). Free of charge (12(5)). Checked 25 Oct 2026.
6. legislation.gov.uk: UK GDPR, Art. 12A (applicable time period). One month beginning with the relevant time: the latest of receipt of the request, receipt of identity information requested under Art. 12(6), or payment of any fee. Extendable by two further months for complexity or number of requests, by notice given within the first month with reasons. The clock pauses while the controller waits for information it reasonably needs to identify what an Art. 15 request covers. Checked 25 Oct 2026.
7. legislation.gov.uk: UK GDPR, Art. 15 (right of access, as amended). Access to the data, purposes, categories, recipients, retention, rights, the right to complain to the controller and to the Commissioner, the source, and (h) automated decision-making subject to the Art. 22C safeguards with meaningful information about the logic involved. Controllers need only make reasonable and proportionate searches (15(1A)). A copy of the data (15(3)). Checked 25 Oct 2026.
8. legislation.gov.uk: UK GDPR, Arts 22A–22D (automated decision-making), in force 5 Feb 2026. Art. 22 is replaced by Arts 22A–22D. A significant decision based solely on automated processing (no meaningful human involvement) needs safeguards (22C): information about the decision, the chance to make representations, human intervention, and the ability to contest the decision. Checked 25 Oct 2026.
9. legislation.gov.uk: Data Protection Act 2018, s. 164A (complaints to the controller). A data subject may complain to the controller. The controller must make it easier to complain (for example with an electronic form), acknowledge the complaint within 30 days, and then respond without undue delay and tell the complainant the outcome. Checked 25 Oct 2026.
10. California Privacy Protection Agency: California Consumer Privacy Act, Civ. Code §§ 1798.110 and 1798.130 (statute effective 1 Jan 2026). § 1798.110: the categories collected, sources, business or commercial purpose, categories of third parties, and the specific pieces of personal information. § 1798.130(a)(2)(A): free of charge, within 45 days of receiving a verifiable consumer request; the time to verify does not extend the 45 days; “may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period.” Checked 25 Oct 2026.
11. California Privacy Protection Agency: CCPA Regulations, Cal. Code Regs. tit. 11, §§ 7021 and 7024 (effective 1 Jan 2026). § 7021: confirm receipt within 10 business days; respond within 45 calendar days of receipt regardless of verification time; up to 45 more days (90 in total) with notice and an explanation. § 7024(h): you may ask for information collected beyond the 12-month period, as long as it was collected on or after 1 January 2022. Checked 25 Oct 2026.
12. California Privacy Protection Agency: File a complaint. The CPPA takes complaints from consumers about businesses’ privacy practices. Checked 25 Oct 2026.

Not covered yet: other US state privacy laws, and countries outside the EU, EEA and UK. We add a law only after checking its official text.