Subject Access Request to Amazon

Four companies share the controllership, and Amazon publishes which does what. The privacy notice names "Amazon Europe Core SARL, Amazon EU SARL, and Amazon Media EU SARL, all three at 38 avenue John F. Kennedy, L-1855, Luxembourg and Amazon Digital UK Limited of 1 Principal Place, Worship Street, London, EC2A 2FA, UK (together 'Amazon Europe')". Its data controllers page then splits them: Amazon Europe Core runs the amazon.co.uk website, Amazon EU S.à r.l. covers the sale of retail products and services and Marketplace, Amazon Media EU covers digital content, and Amazon Digital UK covers Prime Video and Amazon Music. Orders, Marketplace and account records — what most requests are about — sit with Amazon EU S.à r.l., which is the address given above. One request through the route below reaches Amazon; the split matters if you need to name a controller in a complaint. The request route is a signed-in tool, not a letter. Amazon's privacy notice says: "If you wish to do any of these things, please contact Customer Service or, to submit a data subject access request, go to Request My Data." Request My Data is behind the Amazon sign-in wall, and Amazon publishes no postal or email address for making a request — the Luxembourg address above appears only where the notice identifies its controllers. A request in writing is valid in law however you send it, but nothing on these pages invites one, so expect the tool to be the route Amazon actually processes. Check your account first, because Amazon tells you to. The request page is scoped to "personal data that isn't available in Your Account, such as your search history", and lists what is already there: order history, payment methods, addresses, account settings and communication preferences. Where a request earns its keep is the rest — search and browse history, Alexa voice recordings and transcripts, advertising and interest profiles, Kindle and Prime Video activity, seller and returns correspondence. No timescale is published anywhere. "one month", "30 days", "working days" and every numeric variant return nothing across the privacy notice, the request page and the data controllers page. The one month you are entitled to comes from the law, not from a promise Amazon has made, and the only commitment on any of those pages — "We will respond to your inquiry promptly" — is attached to a different complaints process. The email address on the privacy notice is not the request route. Amazon publishes eu-privacy@amazon.co.uk once as the data protection officer's contact "if you have any concern about privacy at Amazon Europe or want to contact one of our data controllers", and again for complaints about its handling of personal information generally. It is not offered as a way of making a subject access request, which is why it is not listed above. Amazon names the Commission Nationale pour la Protection des Données in Luxembourg as its "principal supervisory authority" and says a complaint can also go to the Information Commissioner's Office or another local authority. The privacy notice's own Last Updated line reads 1 August 2024. Nothing on it, on the request page or on the data controllers page addresses a request about someone who has died — "deceased", "died", "death" and "estate" appear nowhere — so there is no published route for one, and rights of access end at death in any event. If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.