Subject Access Request to TikTok

TikTok's privacy policy names two joint controllers for a UK user: TikTok Technology Limited in Ireland and TikTok Information Technologies UK Limited. It also settles which one answers you — TikTok Ireland is responsible for responding, and will liaise with TikTok UK if it needs to. One request covers both. The in-app "Download your data" tool is not a subject access request. TikTok says the file "may include but is not limited to your username, watch video history, comment history and privacy settings", and that if you want categories the tool does not cover — it names information from partners about your activity outside TikTok, and ads-related information — you have to use the web form as well. Ask for those categories by name. TikTok adds two more limits: "Some data may not be available to download, such as data that affects the privacy of others", and the last 24 to 48 hours of some categories may be missing, so a second request later picks up the rest. The file itself is available for up to four days before it expires. On the form, choose "Exercise your rights under data protection laws". Choosing the "I want to download my TikTok data" subcategory sends you back to the in-app tool and then only asks about problems with it; "I want to exercise one of my other rights under data protection laws" opens a free-text box. Two of the three answers to "Do you have a TikTok account?" are dead ends for an access request: answering "No", or "I no longer have access to my account", replaces the access, deletion and objection options with a question-only option, so a locked-out user has to go through account recovery first. Watch what you type into that free-text box. TikTok says it uses "both human and automated means" to sort enquiries based on what is in it, and then adds: "If you include personal data, it may be processed by using automated methods. If you prefer not to have your personal data handled in this way, consider leaving it out of the free-text field." TikTok says the request is free — "You can ask us, free of charge, to confirm what information we process about you, to provide certain information about the processing, and for a copy of your information." It publishes no response time of its own, only "within the relevant periods provided by law"; the one month you are entitled to comes from the law. TikTok publishes no email address for requests and no telephone number. Its Data Protection Officer is reached through a second web form, not an inbox. TikTok names the Irish Data Protection Commission as its lead supervisory authority and does not mention the ICO anywhere in the privacy policy. A UK user can still complain to the ICO. TikTok is replacing its UK privacy policy. The new version says "This Privacy Policy applies to you from 11 November 2026 or when you make a choice about ads", which is tied to a change in how TikTok shows advertising to UK users. The joint controllers and the UK postal address are identical in both versions. A request about someone who has died is not a subject access request — the right of access ends at death — and TikTok publishes no bereavement or memorialisation route in its Help Centre. If you want to word the request yourself, our free letter generator will write it, and our free response checker will tell you whether the reply you get back is complete.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.