The GDPR gives you the right to ask a company for a copy of the personal data it holds about you and information about how it uses it.
- The company must answer within one month, which it can extend by two months where necessary, and the first copy is free.
- In a damage dispute, an access request can bring out inspection records, notes and correspondence linked to your rental.
You asked the rental company for its evidence and got a one-line answer: "our inspection found damage". Under the GDPR you have a separate, independent right. You can ask the company for a copy of the personal data it holds about you, and it has to answer within a fixed time. In a damage dispute, that can bring out records you would otherwise never see.
What the right of access covers
The European Data Protection Board (EDPB) explains the right of access in its guidelines 01/2022. It has three parts:
- confirmation of whether the company processes data about you;
- access to that data, usually as a copy;
- information about the processing: purposes, categories of data, recipients, how long data is kept and your other rights.
The EDPB adds a few points that matter in practice:
- you do not have to give reasons for your request;
- the first copy must be free of charge, even if producing it is costly;
- there is no required format, and you do not have to cite the GDPR, although it helps;
- the company must answer as soon as possible and in any case within one month of receiving the request. Where necessary it can extend this by two further months, and it must tell you why.
Why it helps in a damage dispute
A damage claim is built on records: the pick-up check, the return inspection, internal notes, emails with the repair shop, perhaps scanner images or telematics data. Some of these are linked to your name, booking number or the car while you rented it.
Konsumentverket advises asking for photos, records and receipts for repair costs when you are billed for damage you do not recognise. An access request adds a legal deadline to that question. It does not replace your objection; it runs next to it.
| What you might receive | Why it matters |
|---|---|
| Inspection records at pick-up and return | Shows what was recorded and when |
| Internal notes on your rental | Can show who found the damage and how |
| Correspondence about your claim | Shows how the amount was decided |
| Who the data was shared with | For example a claims handler or collector |
| Location or vehicle data linked to you | Relevant if the company relies on it |
The EDPB's guidance on connected vehicles notes that location data is high-risk, can reveal habits of individuals and should not be collected continuously by default. If a company relies on such data in a claim, you can ask about it.
Find the right address
Look in the company's privacy notice for a data protection officer or a privacy email address. Use that address, not general customer service. If you booked through a broker, the broker may hold data too; you can send a separate request there.
Write the request
Subject: Request for access to personal data (Article 15 GDPR) I rented a car from you from [date] to [date], booking number [number], licence plate [plate], at [location]. Under Article 15 of the GDPR, I request a copy of all personal data you hold about me in connection with this rental, including inspection records at pick-up and return, photos and notes linked to my rental, records relating to the damage claim [reference], and correspondence about me with third parties. Please also tell me the purposes, the recipients and how long you keep this data. I look forward to your answer within one month.
Attach a copy of your booking, not a copy of your passport unless the company asks and there is a real need to confirm your identity. Our letter templates have more letters for a damage dispute.
Note the dates
Write down the date the company received your request. One month later is the deadline, unless the company tells you it needs an extension and why. The deadline calculator helps you keep track of this date next to your chargeback deadlines.
Use what you receive
Compare the records with your own evidence. Look for:
- the time of the return inspection compared with your return time;
- whether damage was noted at pick-up that the claim now treats as new;
- whether the car was rented again before the inspection;
- how the amount was put together.
Then add what you found to your objection. Our guide on which evidence you need shows how to organise it, and the guide on how to dispute a damage claim shows how to write it up.
If the company does not respond
Send one reminder that refers to the one-month deadline. If that fails, you can complain to the data protection authority in your country. That complaint is about the access request, not about the damage itself. For the damage dispute, use the routes in what to do when the rental company does not reply.
Tracking and telematics
Many modern rental cars collect data about location and driving. Read GPS tracking in rental cars and your privacy for what the EDPB says about that.
Frequently asked questions
Do I have to say why I want the data?
No. The EDPB guidelines say you do not have to give reasons for an access request, and the company should not assess why you are asking.
Are photos of the car my personal data?
A photo of a car is not always personal data on its own. But records linked to your name, booking or licence plate during your rental, such as inspection notes, claim files and messages about you, usually are. Ask for everything linked to your rental.
What if the company does not answer within a month?
Send a reminder that refers to the GDPR deadline. If there is still no answer, you can complain to the data protection authority in your country. That is separate from the damage dispute itself.