Subject access request under art. 15 GDPR (Italy)
Published byDocMuse
This document is in Italian
The PDF you download is in Italian — that is the language it has to be filed in, so it is not translated. Everything on this page is here to tell you what it says.
An Italian letter, in Italian, to a company, bank, employer, app or public body asking whether it processes your personal data and for a copy, with purposes, recipients, retention periods and source (art. 15 of Regulation (EU) 2016/679). The controller must answer within one month, and the first copy is free. The Italian data protection authority (Garante) publishes a free model on its website. Send it by PEC, by e-mail to the privacy address in the privacy notice, or by registered post with proof of receipt.
- Made for use in Italy
- Last updated October 14, 2026
Fill out the form
Your answers stay on this device for 7 days, or until you clear them.
Your answers appear in place as you type. The full wording is in the PDF you download.
When to use this document
- You want to know what data your bank in Italy keeps about you.
- A former employer still contacts you and you want to know where it got your data.
- You receive adverts from a company you never gave your details to.
- You want a written request for access to your personal data under the GDPR.
What you fill in
The details the document asks for.
- Sender
- Sender's address
- Sender's codice fiscale (Italian tax code)
- How the letter is sent (printed above the recipient)
- Data controller
- Controller's postal address (from its privacy notice)
- City
- Date
- Customer number or other reference (optional)
- Data or processing the answer should focus on (optional)
Common questions
- How long does an Italian company have to answer a subject access request?
- Without undue delay and at the latest within one month of receipt; the period can be extended by two months for complex or numerous requests, but the controller must say so, with reasons, within the first month (art. 12(3) of Regulation (EU) 2016/679). The Italian Garante publishes a free model for exercising this and the other rights, which you can use instead of this letter.
- What if the controller does not answer, or answers incompletely?
- You can lodge a complaint with the Italian data protection authority, the Garante (art. 77 of the Regulation; arts. 140-bis ff. of the Italian Privacy Code), using the free model on the Garante’s website: by PEC to protocollo@pec.gpdp.it, by registered post or by hand, signed digitally or by hand with a copy of an identity document. Attach the request you sent and proof of its date.
- Does access to personal data cost anything in Italy?
- No: the first copy of the data is free (art. 15(3) of the Regulation). The controller may ask a reasonable fee only for further copies, or refuse requests that are manifestly unfounded or excessive, and must prove it. If you write by e-mail, the answer comes in electronic form unless you ask otherwise; enclose a copy of an identity document, because the controller must be sure it is dealing with you.
How you can sign this document
- Print it and sign by hand. The signature lines in the document are left blank on purpose — sign on them in ink.
- Sign it yourself with a qualified electronic signature. If you already hold a QES — Evrotrust, B-Trust, StampIT, ZealiD or any qualified provider on the EU Trusted List, on a card, a USB token, in a mobile app or in the cloud — our signing guide explains step by step how to sign this exact file without invalidating it. Step-by-step help, and a way to check it worked
DocMuse sells documents, not legal advice. Acceptance always depends on the recipient's rules and your local law.