Short answer
Article 15 of the GDPR gives anyone in the EU the right to a copy of the personal data a company holds about them, plus the purposes, recipients, retention period and source. The first copy is free and the company must answer within one month, extendable by two for complex requests. If you can still log in, the platforms’ own tools are fastest: Accounts Center → Export your information on Instagram and Facebook, Download your data on TikTok, Google Takeout. If you are locked out, hacked or banned, send a written request; Instagram, for example, says to contact it through its privacy form. The file can hold what an appeal or police report needs: login history, devices and changes to your email or phone.
What Article 15 gives you
- Confirmation of whether the company processes your personal data.
- A copy of the data itself. The first copy is free; for further copies the company may charge a reasonable fee.
- The context: purposes of processing, categories of data, recipients, how long it is kept, where it came from, and whether automated decision-making is used.
- A deadline: one month, extendable by two further months for complex or numerous requests, if the company tells you within the first month (Article 12).
The European Data Protection Board’s guidelines on the right of access (final version, April 2023) make the practical points: a request needs no special form or wording, and the company may ask for more information only where it has reasonable doubts about who you are.
Self-service downloads: the fastest route
| Platform | Where | Timing | If you can’t log in |
|---|---|---|---|
| Settings → Accounts Center → Your information and permissions → Export your information → Create export | The email link can take up to 30 days; once ready you have 4 days to download | Instagram says to contact it through its privacy form | |
| The same Accounts Center export tool | As for Instagram | Written request to Meta through the privacy contact in its Privacy Policy | |
| TikTok | Profile → Menu → Settings and privacy → Account → Download your data | A few days to prepare; the file stays available for up to 4 days | TikTok’s online form, linked from its data request page |
| takeout.google.com: choose products, delivery and file type | Usually the same day, sometimes a few days; archives expire after about 7 days and can be downloaded 5 times | Recover the account first, or write to Google’s privacy contact | |
| Any other company | Email or letter to the privacy contact or data protection officer | One month, up to three for complex requests | Same: a written request |
Choose the full date range and a readable format (HTML for reading, JSON for evidence you may hand to someone else). TikTok notes that the last 24 to 48 hours of some data may be missing; request again later if you need them. In the EEA and the UK, TikTok also lets you transfer your data to a third-party service.
When you can’t log in: a written request
The right of access doesn’t depend on a working login. Send a short written request to the platform’s privacy channel and keep a copy:
“Subject: Access request under Article 15 GDPR. I live in [country] and use [platform] as [username, email, phone]. I can no longer access this account. Please provide a copy of all personal data you hold about me, including login history, IP addresses, devices, and changes to the email address and phone number on the account, together with the purposes, recipients, retention periods and sources of that data. I expect your reply within one month, as Article 12(3) GDPR requires.”
Give the identifiers the platform needs to find the account, but don’t send a passport scan unless it asks and the request is reasonable. Note the date you sent it: the one-month clock starts there.
What to look for in the file after a hack or ban
- Login history and IP addresses: when and from where someone else got in.
- Devices signed in to the account, and the dates.
- Changes to email, phone and password: the moment of takeover.
- Messages and posts sent from the account after the takeover, which you can show weren’t yours.
- The content behind a ban: the posts a reviewer will need to see, for example at Appeals Centre Europe.
This is the evidence a platform appeal, a police report or a dispute body asks for. For a takeover in progress, start with our hacked account recovery steps and sign out unknown devices.
If they don’t answer — or answer badly
Silence after a month (or after an extension you were told about), a refusal without a valid reason, or a file that is obviously incomplete are all grounds for a complaint. Write once more with the date of your first request, then complain free of charge to your data protection authority; see how to file a GDPR complaint. A company may refuse or charge only for requests that are manifestly unfounded or excessive, for example the same request repeated again and again, and it has to justify that.
Frequently asked questions
Is a GDPR access request free?
Yes, the first copy is free. A company may charge a reasonable fee for further copies, or for requests that are manifestly unfounded or excessive, which it must justify.
How long does the company have?
One month from receiving your request. For complex or numerous requests it can extend by two more months, but it has to tell you within the first month.
Can I get the data of a disabled or hacked account?
Yes. The right of access doesn’t depend on being able to log in. Instagram, for example, says to contact it through its privacy form if you can’t access your account.
Does downloading my data delete it?
No. Downloading only gives you a copy; Google, for example, says plainly that a Takeout export doesn’t remove anything from its servers. Deletion is a separate right.
Sources: General Data Protection Regulation — Regulation (EU) 2016/679, Articles 12 and 15, European Data Protection Board — Guidelines 01/2022 on the right of access, Instagram Help Center — review and export a copy of your information, TikTok Support — requesting your data, Google Account Help — how to download your Google data