Right-of-access letter: ask where they got your number

If a company keeps calling and you do not know how it got your number, you can ask: the right of access lets you request the data it holds about you and, if it did not get them from you, any available information about their source. Fill in its details and yours and we will prepare a letter, ready to copy or print, that follows the official form of the Spanish Data Protection Agency (AEPD).

Add as a preferred source Download onGoogle Play Download onApp Store

Everything happens in your browser: what you type is not sent to NoCall or stored anywhere.

The companyCompany nameThe company calling you, as it introduced itself.Company address or email(optional)If you know it: it usually appears in the privacy policy on its website, sometimes as the data protection officer's contact.

The callsNumber that called you(optional)For example, 400 123 456.Date or dates of the calls(optional)For example, 20 and 22 October 2026.

Your detailsYour full nameYour ID card, NIE or passport number(optional)The AEPD form has a line for it. You do not need to attach a copy.Your phone numberThe number whose source you want to know.Your email or address for the replyThe company must send the information there.Town or city(optional)For the place-and-date line.

How to send it

Send it to the company in a way that proves it was received: the data protection channel shown on its website, an email, or a registered or courier letter with acknowledgement of receipt. You do not have to use the channel the company suggests: any official contact point of the company will do.
Sign it: the request must identify you and be signed. If the company has doubts about your identity, it can ask for more information, but you do not need to attach a copy of your ID.
The company has one month from receiving the letter to answer, and access is free of charge.
Keep a copy of the letter and the proof of sending. If there is no answer within a month, or the answer is unsatisfactory, you can complain to the AEPD with a copy of your request, the answer you got, or any proof that the company received it.
Do not repeat it to the same company too soon: asking for access more than once in six months may be considered repetitive, unless there is a legitimate reason.

Also want them to stop calling? Write a right-to-object letter

Sources (in Spanish)

Formulario para el ejercicio del derecho de acceso (modelo e instrucciones) · Agencia Española de Protección de Datos
Derecho de acceso · Agencia Española de Protección de Datos
Reglamento (UE) 2016/679, General de Protección de Datos, artículo 15 · Diario Oficial de la Unión Europea

This content is for information only and is not legal advice.

Which countries it covers

The letter follows the AEPD's official form for the right of access and relies on Article 15 GDPR. It is meant for companies that call you in Spain.

The letter is created in your browser. We do not send or store what you type; we only log that a letter was created, without its content.

Frequently asked questions

Can I ask a company where it got my number?

Yes. With the right of access (Article 15 GDPR) you can ask for, among other things, a copy of your data, what it is used for, who it was disclosed to and, where it was not collected from you, any available information as to its source.

How long does the company have to answer, and what does it cost?

One month from receiving your request, free of charge: that is what the AEPD's official form asks for.

What if they do not answer?

If your request is not dealt with within a month, or the answer is unsatisfactory, you can file a complaint with the AEPD. You will need a copy of the request you sent and the answer you got, or any document proving the company received it.

Do I need to attach my ID?

No. According to the instructions of the AEPD form, if the company doubts your identity it can ask for additional information, without asking for or keeping copies of your ID card, NIE or passport.

How is it different from the right-to-object letter?

With the right of access you ask what data the company holds about you and where it got them. With the right to object you ask it to stop using them for marketing. You can send both.