How do I request a copy of all the data a company has on me?
Last updated: 2026-07-12 · Educational content; not legal advice.
Short answer
Two rights let you do this. Your right of access under RA 10173 §16(c) lets you demand, in reasonable form, the contents of the personal data a company holds on you, its sources, who it was disclosed to, and how it was processed. Your right to data portability under RA 10173 §18 goes further: where your data is processed electronically in a structured, commonly used format, you can obtain a copy in an electronic format you can reuse or move to another provider. Send a written request to the company's Data Protection Officer identifying yourself; the controller has a duty to respond within a reasonable period.
Primary sources
Frequently asked
What exactly can I ask for?
Under §16(c): the actual contents held about you, the sources of the data, the names and addresses of recipients it was shared with, the manner and reasons for processing, and details of any automated decision-making. Under §18: a reusable electronic copy of data you provided that is processed by electronic means.
Can they charge me or delay indefinitely?
A controller can apply reasonable, proportionate handling but must act within a reasonable period and cannot use fees or delay to defeat the right. Unreasonable refusal or stalling is something you can raise with the NPC.
How is this different from asking them to delete my data?
Access and portability get you a copy of what they hold; erasure (RA 10173 §16(e)) orders them to remove it. You can use access first to see everything they have, then decide what to demand corrected or deleted.
Take action
Related issues
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.