Subject Access Request to Apple

Apple names one controller for a UK user. Its privacy policy says personal data relating to individuals in the European Economic Area, the United Kingdom and Switzerland is controlled by Apple Distribution International Limited in Ireland. That company has no UK ICO registration; five other Apple group companies do. There are two published routes and they are not equivalent. The Data and Privacy page at privacy.apple.com is the self-service export, and you have to sign in to the Apple Account the request is about — Apple says you must sign in so that your identity can be verified. If you cannot sign in, or you want data the export does not return, Apple's privacy policy points somewhere else: you can make a request at apple.com/legal/privacy/contact, a web form that asks for your country, name, email and a description of what you want, and needs no Apple Account. That form describes itself first as a channel for privacy enquiries, for contacting Apple's Data Protection Officer and for appealing a decision about a privacy request, so say plainly in your message that you are asking for a copy of your personal data. Apple publishes no postal or telephone route for a request. The export leaves things out, and it is not the same as a subject access request. Message content is not included, because Apple says messages are encrypted on your device. Payment details, device identifiers and email addresses come back masked. AppleCare case notes and call transcripts are not in it, and neither are Apple Retail call transcripts or FaceTime call invitation logs; Apple asks you to email privacy_response@apple.com for the first three and to use the privacy form for the last. Apple names the United Kingdom for the retail transcripts route. Apple also states a general carve-out: anything it does not provide is either not personally identifiable, held in a form Apple cannot decrypt, held only briefly, or not stored by Apple at all. Apple gives users in the United Kingdom two things it does not give everyone. You can request App Store information and your app installation and push notification activity as separate subsets, and you can schedule those as a one-time or recurring download — daily for 30 days or weekly for 180 days. That schedule is a download frequency, not a response deadline. A separate address, dpo@apple.com, appears on Apple's Privacy Governance page and in the ICO register. Apple describes it as a process for employees to raise privacy queries, so it is not the customer request route. Apple publishes no deadline for answering a data request. Its privacy policy says most substantive contacts receive a response within seven days, but that sentence is about privacy enquiries rather than the request itself. Once your export is ready you have 14 days to download it before Apple removes it and you have to ask again. Apple also publishes its grounds for refusing: it says a request may be denied if it jeopardises the privacy of others, is frivolous or vexatious, or would be extremely impractical or unreasonable. Rights under data protection law end when a person dies, so this is not a subject access request. Apple runs a separate Digital Legacy process and says it requires and verifies legal documentation, generally a death certificate and sometimes a court order. Apple names France, Germany, Japan, Australia and New Zealand as places where other documentation is accepted instead; it does not name the United Kingdom, so a UK applicant should expect the Legacy Contact route or a court order. If you want the background first, read what a subject access request is and how to word one. Apple is the third large technology company on this site with a sign-in wall in front of its data tools — the same pattern applies at Google and Amazon, and both of those publish no ungated route at all.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.