Google DSAR: Request All Your Personal Data
Under GDPR, CCPA, and similar privacy laws, you have the right to request a complete copy of all personal data Google holds about you. This goes far beyond what Google Takeout provides, as a formal DSAR requires Google to disclose inferred data, profiling categories, third-party data sources, and specific purposes for each processing activity. This guide provides a ready-to-use template and step-by-step instructions.
Prerequisites
- Google account (personal or workspace)
- Email address for correspondence
- Proof of identity (government ID may be requested)
Download Your Data via Google Takeout First
Before filing a formal DSAR, use Google Takeout at takeout.google.com to download all available data categories. Select all products and request the export. This provides your search history, location data, emails, photos, and other content. However, Takeout does not include inferred data, advertising profiles, or information about automated decision-making that a formal DSAR requires.
Prepare Your DSAR Letter
Draft a formal letter referencing Article 15 of GDPR or CCPA Section 1798.100 requesting: all personal data held about you, the purposes of processing, categories of data, recipients of your data, retention periods, information about automated decision-making including profiling, the source of data not collected directly from you, and transfers to third countries. Include your full name, email address associated with your Google account, and a statement identifying yourself as the data subject.
Submit to Google Data Protection Office
Submit your DSAR through Google's Privacy Help Center at support.google.com/policies/contact/general_privacy_form or email to data-protection-office@google.com. Reference that this is a formal data subject access request under applicable law. Google is required to respond within 30 days under GDPR or 45 days under CCPA.
Tip: Keep a copy of your submission with timestamp for evidence if you need to escalate to a data protection authority.
Review the Response
Google's response should include all personal data processed, not just what is available through Takeout. Verify the response includes advertising interest categories, inferred demographics, data shared with third parties, and any automated decision-making. If the response appears incomplete or only directs you to Takeout, follow up requesting the specific categories that were missing.
Request Deletion of Specific Data
After reviewing your data, you can submit a deletion request under Article 17 GDPR (right to erasure) or CCPA Section 1798.105 for data you want removed. Google may retain some data for legal compliance or legitimate interest, but must explain which data is retained and the legal basis for retention.
Escalate to Data Protection Authority if Unsatisfied
If Google's response is inadequate, incomplete, or untimely, file a complaint with your relevant data protection authority. EU residents can file with their national DPA. California residents can contact the California Privacy Protection Agency. The complaint should include your original request, Google's response, and an explanation of why it is insufficient.