Subject Access Request to Snapchat

Snapchat is a Snap Inc. product. Snap's EEA and UK Privacy Notice says Snap Inc., in Santa Monica, is the controller of a UK user's personal information; its Terms of Service separately say the company responsible for the service outside the United States and the Asia-Pacific region is Snap Group Limited, at the London address above. Snap Group Limited holds the UK data protection registration. Snap publishes no UK representative — its list of local representatives covers Saudi Arabia, Singapore, Türkiye, India and Germany. Snap's EEA and UK Privacy Notice currently carries an effective date of 21 September 2026, and unlike its Privacy Policy and Terms it has no earlier version published alongside it, so it is the only notice Snap offers a UK reader. The route Snap publishes is the My Data download, and it runs only from inside your own account: log in at accounts.snapchat.com, choose My Data, pick what you want and the date range, confirm an email address and submit. Snap says it aims to deliver the file within 7 days and that large downloads take longer, which is its own service target and not the one-month deadline the law sets. Snap also says a download request cannot be cancelled once made. What the download contains: login history and account information, user and public profiles, Snap history, saved chat history, Memories, purchase and shop history, Snapchat support history, friends, location, search history and Bitmoji. What it does not contain is the thing most people are looking for. Snap's own answer to Can I request a copy of a Snap? is that Snapchat cannot provide copies of Snaps to Snapchatters, that delete is the default, and that opened or expired Snaps typically cannot be retrieved from its servers by anyone for any reason — unopened one-on-one Snaps are deleted after 31 days. Snap History is a record that a Snap was sent, not the Snap. Snap says the same of chats and Memories you have deleted, viewed or let expire: "Unfortunately, this means we cannot recover these for you." A request cannot produce what has already been deleted, so if something matters, ask early. Snap does publish a data protection officer's address, but not in a form you can copy: on the UK notice it is written as "dpo [at] snap [dot] com", under a heading about complaints and questions, and Snap's own Privacy Policy answers "wish to contact our Data Protection Officer?" by linking its support ticket form rather than a mailbox. That form can be opened without an account, but the required "Reason for contact" offers only an objection to processing or a question about a digital platform law — there is no option for a copy of your data. A written request to a controller is still valid in law wherever it arrives. Parents: Snap says parents and guardians of 13- to 17-year-olds may make privacy requests for a teenager, then says it will not release account details to an unauthorised party and recommends working through the download with your child. Its article tells you to connect to the teenager's account through Family Center first, and the "online form" it links for anything else is a self-help article, not a form. If the person has died: Snap says its privacy policies do not allow it to grant access to the account. It adds that "Protecting Snapchatters' privacy is important to us, so we only accept requests from a verified email address associated with the Snapchatter's account." Data protection rights end at death, so this is not a subject access request and GetMySAR cannot take it. Where a Snap matters to a criminal investigation, Snap's own advice is to contact your local police. Google and Amazon work the same way — the request has to come from the signed-in account. If you are not sure what you can ask for, start with what a subject access request covers, and our free letter generator will word one for you.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.