Data & Privacy: templates and forms

Exercising the GDPR rights of access, erasure or objection (Spain)

Why it matches: You closed an account years ago and want the company to delete everything it still keeps.

The Spanish Data Protection Agency (AEPD) publishes free forms for exercising these rights: you do not need DocMuse for it. This Spanish letter, in Spanish, is for anyone who wants to know what personal data a company or body in Spain holds about them, have it erased or stop its use. It exercises, before the data controller, the right of access (Article 15 GDPR), erasure (Article 17) or objection (Article 21), as you choose, names the data and the reason, and recalls the one-month deadline and that it is free. Send it by burofax, certified post or by hand, or to the e-mail address in the privacy notice.

Request for removal from a bad-debtor file (Spain)

For someone listed in Spain in a bad-debtor file such as ASNEF or Experian for a debt that is paid, does not exist, is disputed, was never notified, is over five years old or is under fifty euros. The letter exercises the right to erasure against the company running the file, asks for processing to be restricted while it checks, and points out the one-month deadline to answer (article 20 of Spain's data protection act, LOPDGDD, and articles 12 to 19 GDPR); a copy goes to the creditor. Exercising these rights is free, and the AEPD offers its own model forms. Send it by burofax or through the file's written channel. In Spanish.

Request for erasure of personal data (Bulgaria)

Why it matches: You want a company in Bulgaria to delete the personal data it holds about you.

The right to be forgotten under Article 17 of the General Data Protection Regulation. It is not unconditional: data the organisation keeps by law, for accounting, or to defend a legal claim stay. So the request names exactly which data and on what ground, and asks for a written answer — including when the answer is a refusal, so that there is something to appeal against.

Complaint to the Commission for Personal Data Protection (Bulgaria)

Why it matches: You asked an organisation to delete or show you your data and it refused without good reason.

The step to take when a controller has not answered your request or has refused it without good reason. The order is the same as in consumer disputes: first a request to the organisation, then a complaint to the commission with a copy of the correspondence attached. A complaint with no prior request is usually sent back, because there is no refusal to examine.

Application to block registration data from disclosure (Austria)

The application to the registration authority (Meldebehörde) to block your address from register enquiries (§ 18(2) of Austria's Registration Act, MeldeG): without a block, anyone who knows your name and a few other details can obtain your address. The block must be granted where you show a protectable interest to be credible — stalking, violence, threats or a well-founded fear of revenge, for instance — and lasts up to five years, even after you deregister. With your reasons, evidence and any children under 18. In German, ready to print and sign.

Data processing agreement under Art. 28 GDPR (Germany)

The data processing agreement (Auftragsverarbeitungsvertrag, AVV) every business in Germany needs when a service provider processes personal data for it — hosting, cloud software, payroll, newsletters, IT support. It contains everything Art. 28(3) GDPR requires: subject-matter, duration, nature and purpose, types of data and data subjects, instructions, confidentiality, security, sub-processors, assistance, deletion or return, information and audits, with annexes for the technical and organisational measures and the sub-processors. Free models from supervisory authorities and the European Commission also exist. In German.

Objection to processing for direct marketing (Bulgaria)

Marketing calls, messages and letters stop on an objection under Article 21 of the General Data Protection Regulation. Unlike the other rights, there is no balancing here and no exceptions: on an objection to direct marketing, processing for that purpose ends. The document lists the channels separately, because unsubscribing from the newsletter does not stop the phone calls.