Create a Data Rights Letter Online Free
🚀 Build Your Data Rights Letter
Choose your letter type below — the deadline and letter text update live. Nothing leaves your device.
⚖️ Jurisdiction & Letter Type
👤 Your Details
🏢 Organisation You're Writing To
📋 What You're Requesting
⏱️ Response Deadline
Calculated as one calendar month from the letter date above. Both UK and EU GDPR allow a further two-month extension for complex or numerous requests, provided the organisation tells you within the first month and explains why.
Quick answer: Choose UK GDPR or EU GDPR, then pick Subject Access Request to see what data an organisation holds about you, or Right to Erasure to ask them to delete it. Enter your details and the organisation's, describe what you're requesting, and — for erasure — select which Article 17(1) ground applies. The one-calendar-month response deadline is calculated automatically from the letter date, including the two-month extension for complex requests and, for UK subject access requests only, a note about the 2026 "stop the clock" rule. Click Download PDF for a signature-ready letter. Everything runs locally in your browser with jsPDF — not a screenshot image. This is a general template, not legal advice.
- Cost: Free, unlimited letters, no signup.
- Where it runs: 100% in your browser — no upload, no server storage.
- Two letter types: Subject Access Request (Article 15) and Right to Erasure (Article 17).
- Two jurisdictions: UK GDPR and EU GDPR, with the correct references for each.
- Auto deadline: One-month response date calculated live, with the calendar-rollover edge case handled correctly.
- UK stop-the-clock aware: Notes the SAR-only pause rule in force since 5 February 2026.
⚖️ General Template, Not Legal Advice: Data protection law is detailed and fact-specific. This tool provides a general-purpose starting point — for anything contentious, consult a solicitor or your national data protection authority.
🕒 Stop-the-Clock Is UK-Only, SAR-Only: The pause for identity/clarification only applies to UK subject access requests. Erasure requests, and all EU GDPR requests, don't have this pause.
📮 You Send It, Not Us: This tool only creates the document. Sending it — by post, email, or a form on the organisation's own site — is up to you.
✅ Privacy: Your details are processed locally — never uploaded, transmitted, or stored anywhere.
✅ 100% Private: Your letter is generated locally in your browser using JavaScript. No data is ever uploaded to a server or stored anywhere.
Note: Your data will be cleared once you close or refresh the page, so download your PDF before leaving.
How to Create a Subject Access Request or Erasure Letter
Choose Jurisdiction & Letter Type
UK GDPR or EU GDPR, plus Subject Access Request or Erasure.
Enter Your Details & the Organisation's
Add your contact details and who you're writing to.
Describe the Request
Specify the data involved, and select an erasure ground if applicable.
Download the PDF
Check the deadline, then save your signature-ready letter.
🔒 Your Details Never Leave Your Device
This tool builds the entire letter using jsPDF running inside your browser tab. There is no upload step, no server-side processing, and no network request containing your name, address, or the organisation you're contacting.
Who Uses This Letter Generator?
Consumers & Online Shoppers
Find out what a retailer or service holds about you, or ask them to delete it.
Former Employees
Request a copy of your HR file, or ask for erasure once retention periods have passed.
App & Social Media Users
Ask a platform what profile and behavioural data it has collected about you.
Bank & Insurance Customers
Request records held by a financial institution about your account activity.
Advocacy & Legal Support Groups
Help someone draft a first data rights letter before escalating further.
Marketing List Recipients
Ask a company to erase your data after withdrawing marketing consent.
Why Use This GDPR Letter Generator?
- Fully Client-Side: jsPDF builds the whole letter in your browser — no upload.
- Real Vector Text: Sharp, small-file-size PDF output — not a flattened screenshot.
- Side-by-Side Preview: Check your letter next to the form as you build it.
- Correct Deadline Math: Handles the "same date next month" rule, including month-end edge cases.
- UK/EU Aware: Cites the right regulation and regulator for your jurisdiction.
- Article 17 Grounds Built In: Select the applicable erasure ground instead of guessing the wording.
- Stop-the-Clock Aware: Flags the UK's 2026 SAR-only pause rule automatically.
- 100% Free & Private: No account, no watermark, no server storing your data.
GDPR Data Rights Letter Generator – Complete Guide
Most organisations respond fine to a clear, well-worded data rights request — the trouble usually starts when the letter is vague, or when nobody involved knows what the actual deadline is. This tool handles the legal citations and the date maths so you can focus on saying clearly what you want.
Subject Access Request vs Right to Erasure
| Aspect | Subject Access Request (Article 15) | Right to Erasure (Article 17) |
|---|---|---|
| What you get | A copy of your personal data, plus supplementary info | Deletion of your personal data |
| Reason needed? | No | Yes - must fit one of the Article 17(1) grounds |
| Can be refused? | Limited exemptions apply | Yes, in specific circumstances (legal obligation, legal claims, freedom of expression) |
Response Deadlines: What Changed in 2026
Both UK GDPR and EU GDPR set a baseline of one calendar month to respond, extendable by a further two months for complex or numerous requests (the organisation must tell you within the first month and explain why). Since 19 June 2025 (Royal Assent) with SAR-specific provisions in force from 5 February 2026, the UK's Data (Use and Access) Act 2025 added a new Article 12A to UK GDPR:
| Rule | UK GDPR (since 5 Feb 2026) | EU GDPR |
|---|---|---|
| Baseline deadline | 1 calendar month | 1 calendar month |
| Extension for complexity | +2 months, with notice | +2 months, with notice |
| "Stop the clock" pause | Yes, for Article 15 (SAR) only, while awaiting ID/clarification | No equivalent provision |
| Applies to erasure requests? | No - Article 12A is SAR-specific | No |
This reflects guidance published as of September 2026. Confirm current rules with the ICO (UK) or your national supervisory authority (EU) before relying on a specific deadline in a dispute.
Article 17(1) Grounds for Erasure
A Right to Erasure request needs to fit one of the grounds in Article 17(1). This tool lets you select the ones that apply, which get inserted into your letter:
| Ground | When It Applies |
|---|---|
| No longer necessary | The data isn't needed for the original purpose anymore |
| Consent withdrawn | Consent was the legal basis, and there's no other basis to rely on |
| Objection to processing | You've objected and there are no overriding legitimate grounds |
| Unlawfully processed | The data was processed in breach of the law |
| Legal obligation | Erasure is required to comply with a legal obligation the controller is subject to |
How This Generator Actually Works
Choosing a jurisdiction and letter type swaps the legal citations and body paragraphs to match — UK letters reference the ICO and, for SAR, the stop-the-clock provision; EU letters reference your national supervisory authority generically, since there are 27 different ones. Entering a letter date triggers a live calculation of the one-month deadline, correctly handling the "same date next month" rule and its edge case (a date sent on the 31st resolves to the last day of the following month if that date doesn't exist). Selected erasure grounds are inserted as a list in the letter body. On download, jsPDF draws the whole letter as genuine vector text - not a picture of text - directly onto a PDF page, wrapping and paginating automatically for longer entries. Nothing ever touches a server.
Security and Privacy Considerations
- No Data Upload: Every field you fill in stays on your device.
- No Server Processing: PDF generation runs entirely as client-side JavaScript.
- No Storage: Nothing about your letter is saved once you close or refresh the tab.
- No Account Needed: There is no login, tracking, or usage cap.
Browser Compatibility and Technical Requirements
This GDPR Data Rights Letter Generator works in modern browsers that support JavaScript PDF generation (jsPDF) and Blob downloads.
- ✅ Chrome/Edge 76+
- ✅ Firefox 55+
- ✅ Safari 13.1+
- ✅ Mobile Chrome (Android), Mobile Safari (iOS) — download supported
Troubleshooting Common Issues
Explanation: This note only shows for UK GDPR + Subject Access Request, since it doesn't apply to EU GDPR or to erasure requests under either jurisdiction. Solution: Confirm both toggles - UK GDPR and Subject Access Request - are selected.
Explanation: Grounds only apply to Right to Erasure letters, not Subject Access Requests. Solution: Select the Right to Erasure letter type to reveal the grounds checklist.
Explanation: The PDF needs both parties identified to be a meaningful letter. Solution: Fill in your full name and the organisation name, then download again.
Explanation: When a letter is dated on the 29th, 30th, or 31st and the following month is shorter, the deadline correctly rolls to that month's last day rather than spilling into the month after. Solution: This is expected behaviour, not a bug - double-check the displayed date against a calendar if unsure.
Frequently Asked Technical Questions
Question 1: What actually builds the PDF - is it a known library?
Answer: This tool uses jsPDF, a widely used open-source JavaScript library for generating PDF documents in the browser, loaded directly in your browser tab.
Question 2: How is the one-month deadline calculated?
Answer: The tool takes the letter date, advances it by one calendar month, and checks whether the resulting day-of-month matches the original. If it doesn't - because the target month is shorter - it falls back to the last day of that month, which mirrors the standard legal convention for "one calendar month" deadlines.
Question 3: How does the jurisdiction toggle change the letter?
Answer: It swaps which regulator is referenced (the ICO for UK, "your national supervisory authority" for EU) and whether the stop-the-clock note is eligible to display, since that provision only exists in UK GDPR and only for Article 15 requests.
Question 4: How are the selected erasure grounds inserted into the letter?
Answer: Each checked ground's associated sentence is collected into a list, which is rendered as a bulleted list in the preview and as indented wrapped text in the PDF, positioned within the erasure request paragraph.
Question 5: Does this tool need an account, server, or API key?
Answer: No. jsPDF and the live preview both run as ordinary JavaScript already loaded by this page — you never need an account or any API key to use it.
Glossary of Terms
- Subject Access Request (SAR)
- A request under Article 15 of the UK/EU GDPR asking an organisation to confirm and provide a copy of the personal data it holds about you.
- Right to Erasure
- A request under Article 17 of the UK/EU GDPR, sometimes called the right to be forgotten, asking an organisation to delete your personal data.
- Data Controller
- The organisation that determines the purposes and means of processing personal data, and who a data rights request is typically sent to.
- Stop the Clock
- A UK-specific provision, in force since 5 February 2026, letting an organisation pause the one-month response deadline for a subject access request while awaiting identity verification or clarification.
- Supervisory Authority
- The independent regulator responsible for enforcing data protection law - the ICO in the UK, or the relevant national authority in an EU member state.
Frequently Asked Questions
Yes, completely free with no watermark, no signup, and no limit on how many letters you create.
No. The letter is built and turned into a PDF entirely inside your browser using JavaScript. Nothing is transmitted over the network.
A Subject Access Request is a request, under Article 15 of the UK GDPR or EU GDPR, asking an organisation to confirm whether it holds your personal data and to provide a copy of it, along with certain supplementary information about how it's used.
A Right to Erasure request, under Article 17 of the UK GDPR or EU GDPR (sometimes called the "right to be forgotten"), asks an organisation to delete your personal data where one of the specific grounds in Article 17(1) applies, such as the data no longer being necessary or consent being withdrawn.
Both UK GDPR and EU GDPR give organisations one calendar month to respond, extendable by a further two months for complex or numerous requests, provided they tell you within the first month. This tool calculates that date automatically from when you send the letter.
Since 5 February 2026, Article 12A UK GDPR (introduced by the Data (Use and Access) Act 2025) lets an organisation pause the one-month clock while it waits for you to verify your identity or clarify a subject access request. This pause applies only to Article 15 subject access requests - there is no equivalent stop-the-clock provision for Article 17 erasure requests.
No. A Subject Access Request does not need a reason, specific wording, or reference to the legislation - any clear request for your personal data is generally sufficient.
Yes, in certain circumstances - for example, where the data is needed to comply with a legal obligation, for the exercise or defence of legal claims, or for freedom of expression and information. An organisation must explain its reasons if it refuses.
UK GDPR is the retained version of the EU regulation that applies in the United Kingdom, now diverging in places following the Data (Use and Access) Act 2025 - such as the stop-the-clock rule for subject access requests. EU GDPR (Regulation (EU) 2016/679) applies across the European Union and does not include that specific UK change.
In the UK, you can complain to the Information Commissioner's Office (ICO). In the EU, you can complain to your national data protection supervisory authority. Many organisations also have an internal complaints process you can try first.
Final Thoughts
A well-drafted data rights letter — clear about what you're asking for, correctly dated, and citing the right article — gets a faster, more useful response than a vague email. This tool builds that letter with a live preview, the correct deadline maths, and a real vector-text PDF — all without your details ever leaving your device.
Choose your letter type above and download your first data rights request!