Your medical records are confidential: Special protections for sensitive data
Exercise your rights: Find out who knows what about you!
Data concerning your religious or political views, your medical history or your trade union membership enjoy special protections. To find out whether companies have stored such data about you, it is best to make a written request using your right of access .
Below, you’ll find a sample letter as a PDF download or as a text to copy and paste into an e-mail. You’ll still have to add your address and the company’s address. If available, you can also add your customer or billing number. Please send the letter directly to the company in the end.
Important: Your request must be handled at no cost to you. Companies can only charge you in cases of unfounded or excessive, repetitive requests. If companies require a copy of a proof of identification, you can redact any information that’s not necessary for your request.
Download the sample letter:
Right of access pursuant to Article 15 GDPR
To whom it may concern:
Pursuant to Article 15 of the General Data Protection Regulation (GDPR) I request to know if my personal data is being processed in your organisation. If this is the case, I demand access to my personal data and the information pursuant to Article 15(1) and (2) GDPR. Specifically, I request information on what special categories of data based on Article 9(1) GDPR are being processed.
Please confirm receipt of my request. In accordance with Article 12(3) GDPR, I ask for information on action taken until the following date at the latest:
In case of non-compliance with my demand, I will contact a data protection authority. Furthermore, I reserve the right to take further legal action, which may include the enforcement of claims for damages according to Article 82 GDPR.
Sincerely,
***
Notes on using this sample letter
- Please enter your address and the company’s address. If available, you can add your customer and/or billing number.
- The company needs to respond without undue delay, at the latest within one month of receipt of your request. That’s why you can enter a deadline one month and three days (for shipping) after mailing the request.
- Please send the letter directly to the company in question (not to consumer protection organisations or authorities).
