Keeping Good Records of Your Data Requests

Why a simple record is worth keeping

When you exercise a data right — asking an organisation for a copy of your personal data, asking it to correct something, or asking it to delete data — you are starting a small process with a timeline attached. Under the UK GDPR, an organisation usually has one month to respond to a request like a data subject access request. A short record of what you sent, and when, is what lets you tell whether that clock has run out.

Records matter most when something does not go to plan. If a reply is late, incomplete, or never arrives, a dated copy of your original request is the single most useful thing you can have. It removes any doubt about what you asked for and when, and it makes a polite follow-up — or a complaint to the regulator — straightforward rather than stressful.

None of this needs to be elaborate. A note in a document, a folder of saved emails, or a few rows in a spreadsheet is enough. The goal is simply that, weeks or months later, you can answer three questions without hunting: who did I ask, what did I ask for, and what happened next.

What to record for each request

A good record captures just enough to act on, and no more. Work through these as a short checklist each time you send a request, and you will have everything you need if you ever have to chase or escalate.

• The date you sent the request, since the response deadline is counted from when the organisation receives it.
• The organisation you contacted, and the email address or postal address you used — this is who the request actually went to.
• What kind of request it was: a copy of your data (access), a correction (rectification), a deletion (erasure), or an objection.
• A saved copy of the exact wording you sent, ideally as the original email or a PDF, so there is no ambiguity later.
• The date a reply is due — usually one month from when the request was received — so you know when to follow up.
• Any reference number the organisation gives you, and the date and outcome of their reply when it arrives.

Turning records into action

A record is only useful if it prompts the right next step at the right time. The most common moment is a missed deadline: if the response date you noted has passed with no reply, your saved request is the evidence you need to send a calm follow-up referencing the original date and what you asked for.

If a follow-up still brings no satisfactory answer, the same record supports a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator. Having the dates, the wording, and any reference number already to hand turns what could be a frustrating exercise into a few minutes of copying from your own notes. Keeping replies alongside requests also helps you see the full picture across several organisations at once.

Over time, a tidy log becomes a quiet map of your own digital footprint — which organisations hold your data, what you have asked them, and where things stand. This article is general information, not legal advice; for guidance on your specific situation, consider speaking to a qualified professional or contacting the relevant regulator directly.

Frequently asked questions

Related terms

• Data Subject Access Request (DSAR)
• Data controller
• Right to erasure
• Data protection regulator