ASOS data incident subject access request letter
Ask ASOS whether your personal data was involved in the 6 October 2026 customer notification incident, request your Article 15 data, and seek erasure only where the law allows it.
After ASOS's 6 October 2026 customer notification incident, this letter asks ASOS.com Limited to say whether it processed or accessed your data, provide the Article 15 information and a copy of data found by a reasonable and proportionate search, and erase data only where Article 17 permits it. It uses the account email and an optional order number to help find the records.
Sample letter
Subject access and erasure request after the ASOS customer notification incident: riley.patel@example.com
ASOS.com Limited ASOS Data Protection Office Greater London House Hampstead Road London NW1 7FB United Kingdom Subject access and erasure request after the ASOS customer notification incident Dear ASOS Data Protection Office, On 6 October 2026, ASOS said in its Regulatory News Service announcement that an unauthorised customer notification had been sent and that it was investigating unauthorised activity involving third-party platforms used to communicate with customers. The announcement said, "Basic personal information including name and contact details may have been accessed." It also said, "We do not believe that payment-card information or account passwords, were impacted." Please tell me whether my personal data was processed or accessed in connection with this incident. My ASOS account email address is riley.patel@example.com. 123456789 I make this request under Article 15 of the UK GDPR. The response period and search standard below reflect sections 76 and 78 of the Data (Use and Access) Act 2025. Please confirm whether ASOS.com Limited processes personal data relating to me and provide the personal data to which I am entitled, based on a reasonable and proportionate search. Please also provide the Article 15 information, including the purposes and categories of processing, recipients or categories of recipients, the retention period or criteria used to set it, the source of the data if it was not collected from me, my rights, the route for making a complaint, any relevant automated decision-making or profiling, and relevant safeguards for international transfers. Please identify any other controller and any processor involved in the relevant processing. Under Article 17, I request erasure of personal data relating to me where an Article 17 ground applies and no Article 17(3) exception applies. This includes incident-related data that ASOS no longer needs or has processed unlawfully. I am not asking ASOS to erase order records or tax records where a legal obligation requires you to keep them, or data needed for the establishment, exercise or defence of legal claims. If you retain any personal data, please state for each category the purpose, legal basis, retention period or criteria, and the specific basis for keeping it. Under Article 12 and Article 12A, please respond without undue delay and before the end of the applicable time period. I understand that the period is one month from the relevant time. If you reasonably require further information to identify the information or processing activities covered by this Article 15 request, please ask me clearly. The period from your request for that information until you receive it does not count towards the applicable time period. If you extend the period by up to two further months because of the complexity or number of my requests, please notify me within the first month and explain the reasons. Please send the response to riley.patel@example.com. Please confirm receipt of this request. Yours faithfully,
Download the files
Download the sample letter as a Word file or PDF and adapt it yourself.
What to keep in mind
ASOS's 6 October 2026 RNS did not give a confirmed affected count. It said names and contact details may have been accessed and payment-card information and account passwords were not believed impacted. This page keeps the request tied to that statement, asks about the visitor's own account, and uses the current UK response rules.
- 01
On 6 October 2026, ASOS said that an unauthorised customer notification had been sent and that it was investigating unauthorised activity involving third-party communication platforms. The RNS said basic personal information including names and contact details may have been accessed. It did not publish a confirmed affected count. It said it did not believe payment-card information or account passwords were impacted.
- 02
Enter the email address used for your ASOS account. Add an order number only when it helps ASOS locate the relevant records. The guide asks for no other personal details.
- 03
The recipient is prefilled as ASOS.com Limited, Data Protection Office, Greater London House, Hampstead Road, London NW1 7FB, United Kingdom. ASOS publishes the Data Protection Office address on its own data protection page.
- 04
The Article 15 request asks ASOS to confirm whether it processes or accessed personal data relating to you and to provide the data and supplementary information covered by Article 15. It also asks ASOS to identify the relevant controller, processors, categories, recipients, retention period or criteria, and safeguards.
- 05
The current response period is one month from the relevant time. If ASOS reasonably asks for information to identify the information or processing activities covered by the Article 15 request, the period from that request until it receives your information does not count. ASOS can extend the period by up to two further months when necessary because of the complexity or number of requests, but it must give notice and reasons within the first month.
- 06
The erasure request is limited to personal data for which an Article 17 ground applies and no exception applies. ASOS may need to keep order or tax records where a legal obligation requires this, or data needed for legal claims. If ASOS keeps anything, the letter asks it to state the purpose, legal basis, retention period or criteria, and basis for keeping each category.
- 07
The send rail has no attachment or signature upload step. The letter does not ask you to enclose an ID copy or other document. Quote order numbers and dates in the letter instead. If ASOS later asks for proportionate identity or clarification information, use the secure channel it specifies.
Send the letter with FrankKi
Check the prefilled ASOS recipient, fill in your account email and optional order number, then choose to send the letter with FrankKi. The checkout shows the destination country and available postal methods. The recipient and sender address blocks remain editable.
Keep the request tied to the incident
The RNS is careful about what ASOS knows at this stage. The letter repeats the company wording and asks whether your own data was processed or accessed. It does not claim that your account was affected, and it does not claim that payment-card data or passwords were accessed.
- Use the ASOS account email that identifies your records.
- Add one order number only if it helps locate the relevant records.
- Ask for the Article 15 copy and supplementary information.
- Ask ASOS to state the basis for each category it keeps.
Use the current response clock
Section 76 of the Data (Use and Access) Act 2025 changed Article 12's wording and inserted Article 12A. The applicable period is one month from the relevant time. If ASOS reasonably asks for further information to identify the information or processing activities covered by the Article 15 request, time stops from its request until it receives the information. ASOS can extend by two further months where necessary because of the complexity or number of requests, but it must give notice and reasons within the first month.
Section 78 also added a reasonable and proportionate search limit to Article 15. The letter asks for that search to cover the records relevant to the account email and optional order number, without asking you to provide extra details in the guide.
Ask for limited erasure
Article 17 does not create an unconditional deletion right. The request is for erasure only where an Article 17 ground applies and no exception applies. ASOS may need to keep order and tax records or data needed for legal claims. If it keeps anything, the letter asks it to identify the category, purpose, legal basis, retention period or criteria, and reason.
Keep the paper route simple
The guide asks only for the account email and optional order number. The send rail has no attachment or signature upload step. Quote order numbers and dates in the letter instead of enclosing copies. If ASOS later asks for a proportionate identity or clarification step, use the secure channel it specifies.
Frequently asked questions
What did ASOS publish about the incident?
In its 6 October 2026 RNS, ASOS said an unauthorised customer notification had been sent and that it was investigating unauthorised activity involving third-party platforms used to communicate with customers. It said, "Basic personal information including name and contact details may have been accessed." It also said, "We do not believe that payment-card information or account passwords, were impacted." The RNS did not publish a confirmed affected count.
What does the letter ask under Article 15?
It asks ASOS.com Limited to confirm whether it processes or accessed personal data relating to you, provide the personal data to which you are entitled, and provide the supplementary information listed in Article 15. The current Article 15 wording limits the response to what the controller can provide from a reasonable and proportionate search.
Did the Data (Use and Access) Act 2025 change the response clock?
Yes. Article 12A now sets the applicable period at one month from the relevant time. If ASOS reasonably needs further information to identify the information or processing activities covered by an Article 15 request, the time from its request until it receives the information does not count. ASOS may extend by up to two further months where necessary because of the complexity or number of requests, but it must notify you and give reasons within the first month.
Can ASOS keep order or tax records?
Article 17 does not require erasure where an Article 17 ground does not apply or an exception applies. The request therefore does not ask ASOS to delete order or tax records where a legal obligation requires retention, or data needed for the establishment, exercise or defence of legal claims. It asks ASOS to state the basis for anything it keeps.
Do I need to send an ID copy or sign in ink?
This template does not require a wet-ink signature or an enclosed document. The send rail has no attachment or signature upload step. If ASOS reasonably asks for information to confirm your identity or clarify which information or processing activities the request covers, ask what it needs and use a secure route.
Sources
These official sources show what the template is based on.
- Update regarding cyber incidentLondon Stock Exchange RNS for ASOS plc
- UK GDPR Article 12 and Article 12Alegislation.gov.uk
- Data (Use and Access) Act 2025, section 76legislation.gov.uk
- Data (Use and Access) Act 2025, section 78legislation.gov.uk
- UK GDPR Article 15legislation.gov.uk
- UK GDPR Article 17legislation.gov.uk
- Data Protection and Privacy on ASOS.comASOS
- Privacy & CookiesASOS
- How do we recognise a subject access request?Information Commissioner's Office
How to Send a Letter Online (No Printer, No Post Office)
Last reviewed 10/7/2026.