How Can I Request a Copy of My Personal Data

A right of access request, also known as Subject Access Request (SAR), allows individuals under GDPR and similar privacy laws to request confirmation of whether their personal data is being processed and to obtain a copy of that data together with information about how it is used. This topic will walk you through the process.

What you can ask for:

• Confirmation of whether your personal data is being processed
• A copy of your personal data
• The purposes of processing
• Categories of personal data processed
• Recipients or categories of recipients of your personal data
• The period for which the data will be stored (or the criteria used to determine that period)

Response time:

Under the GDPR, data controllers must respond to access requests without undue delay and within one month of receiving the request. This period may be extended by an additional two months where requests are complex or numerous.

Where other privacy laws apply (for example, certain U.S. state privacy laws), response timelines may differ.

Who should you contact?

In most cases, the companies through which you complete identity verification (the platforms where you register or use services) act as data controllers. They determine the purposes and means of processing personal data, collect their customers’ personal data, and decide how long the data should be retained. These companies are responsible for responding to data subject rights requests, including requests for access.

In such cases, Sumsub acts as a data processor that carries out data processing on behalf of and for the purposes of these companies. Sumsub can only act according to the instructions established by these companies.

If you would like to know what data is stored about you and how it is used in this context, you should contact the platform through which you were verified and submit your Subject Access Request. There is no specific format required; you can send the request via email. You may also submit your request to chat on this website or privacy@sumsub.com, mention the data controller that shall exercise your Subject Access Request, and we will make sure to pass it on to them.

In certain situations, Sumsub may also act as a data controller, for example, when processing personal data for its own purposes such as maintaining the security and integrity of verification systems, fraud prevention, improving verification technologies, or complying with legal obligations.

In such cases, data subjects may submit requests directly to Sumsub via chat on this website or via privacy@sumsub.com to exercise their data protection rights, including the right of access.

Certain legal exemptions may apply that limit the scope of information that can be provided in response to an access request. For example, personal data may be withheld where disclosure would undermine the prevention, investigation, or detection of crime, including processing carried out for AML/CFT purposes, or where other legal restrictions apply.