How to Request Your Personal Data From an AI Service: Letter Templates and What to Expect
Short answer. A data access request asks an AI provider for information it holds about you as an identifiable person. Identify your account, describe the information you want, use the provider's stated privacy contact and keep a dated copy of your request and any response.
- A data access request concerns personal information linked to an identifiable person, not automatically every file or model parameter associated with an account.
- The provider's privacy policy should identify the organisation responsible for handling requests and explain its contact arrangements.
- A useful request identifies the account, describes the information sought and gives enough detail to help locate relevant records.
- Content ownership, permission to process content and access to personal data are separate questions.
- Keep the request, delivery confirmation, identity-check correspondence and final response together.
What an AI data access request actually covers
An AI data access request is a formal way of asking an organisation what personal information it holds about you and, where the applicable rules provide for it, how that information is used. Depending on the service, relevant records might include account details, profile information, support correspondence, billing records and identifiable conversation history. The precise scope depends on the provider, the information involved and the data protection rules that apply in your country.
The important distinction is between personal data and everything connected with an AI account. A request for your personal information does not automatically entitle you to a copy of a provider's entire training dataset, confidential security documentation, model weights or another person's conversations. A provider may also distinguish information stored in your account from information retained in operational systems.
- Account registration and profile information.
- Conversation history associated with your identity, where retained.
- Information about account activity and service interactions.
- Support messages and correspondence.
- Information about the purposes and categories of processing.
Read the privacy terms before writing
Start with the privacy policy, then look at the terms of service. These documents perform different jobs. The privacy policy generally describes how personal information is collected, used, shared and retained. The terms of service set the contractual conditions for using the product, including restrictions on accounts, permitted uses and sometimes the permissions granted over material submitted by users.
When reading AI terms of service explained in plain English, pay particular attention to the distinction between owning something and permitting someone else to use it. A service may say that you retain ownership of content you submit or generate while also requiring a licence to host, process, display or otherwise operate on that content. That licence does not, by itself, answer every question about personal data. Record the exact wording, the document title and the date of the version you read.
- Find the privacy contact or data protection contact.
- Look for instructions about identity checks.
- Identify any account-specific request portal.
- Note the provider's stated retention and deletion arrangements.
Prepare a request that can be understood
A useful request is specific without attempting to predict the provider's internal database structure. Include the email address or account identifier used for registration, the name of the service and a short description of the personal information sought. If you are interested in a particular period, identify it. For example, you might ask for personal information associated with an account between 1 January and 30 June, including retained conversation records, account details and relevant support correspondence.
Ask for the categories of information held, the purposes of processing, relevant recipients or recipient categories, retention information and an explanation of the source of information where applicable. You can also ask for a copy of the personal data covered by the request. Avoid sending passwords, full payment-card details or unnecessary identity documents. Follow the provider's official identity-check procedure.
Two practical letter templates
The first template is suitable when you want a general account-level response. Replace the bracketed details and send it through the privacy contact identified in the provider's documentation.
- Subject: Personal data access request
- I am requesting access to the personal data your organisation holds about me in connection with my account for [service name]. My account email address is [email address].
- Please provide a copy of the personal data covered by my request and information about the purposes of processing, categories of data, recipients or recipient categories, retention periods or criteria, and the source of information where applicable.
- Please let me know if you require further information to identify my account or process this request. Please also explain the applicable response process and any relevant time limits.
- The second template is for a narrower request: I am seeking personal data associated with my account relating to [specific subject or period]. This includes relevant retained conversations, account activity records and support correspondence where these constitute personal data about me. Please identify any parts of the request that cannot be fulfilled and explain the reason and any available review route.
What to expect after sending the request
A provider may acknowledge the request, ask you to confirm your identity, request clarification or explain that some information falls outside the applicable access right. It may supply information through an account download, a secure portal or another documented channel. The response may be organised by category rather than presented as a readable transcript of every interaction.
Response deadlines vary by jurisdiction and can depend on the complexity of the request, permitted extensions and identity checks. For example, some data protection regimes provide a one-month starting period, subject to specified conditions and extensions. Do not assume that the same deadline applies everywhere. If a response is incomplete, identify the unanswered part precisely and use the provider's stated complaint or escalation route.
Keep a complete record of the exchange
Create one folder for the request. Save the privacy policy version, your submitted letter, the date and method of delivery, any acknowledgement, identity-check instructions and the final response. If the provider uses a portal, retain a copy of the submitted text and any downloadable confirmation. A screenshot may help when a portal does not provide an export.
If your underlying concern is who owns content you generate, keep the relevant terms separately. Look for definitions of input, output, user content and licence. Record whether the wording changes for business accounts or particular features. If the response raises a dispute about contractual rights or statutory access, the provider's official explanation and advice from an appropriately qualified professional are the relevant next sources. Begin by locating the privacy contact and saving the current privacy policy.
Questions readers ask
Can a parent request information about a child's AI account?
That depends on the child's age, the account arrangement, applicable privacy rules and the parent's authority to act. The provider may require evidence of parental responsibility or another form of authorisation.
Will an access request automatically delete my conversations?
An access request and a deletion request are different actions. If you want both, identify them separately and check the provider's retention, deletion and account-closure procedures.
What if I cannot access the email address on my account?
Explain the problem through the official privacy contact and ask what alternative account-identification procedure is available. Avoid sending sensitive documents to an unconfirmed address.
Can I request information about how my conversations were used for training?
You can ask what processing purposes apply to your information and whether it was used in relevant training activities. The response will depend on the provider's records, the applicable access rules and any relevant exemptions.