Ask platforms what they hold about you: a GDPR access request guide for artists, and where India's DPDP Act stands

Every platform you release through keeps a file on you: account details, payout details, listening, and the inferences drawn from them. If you live in the EU, or use a service run by a company established there, you can ask for that file and an explanation of its use. Here is how.

This is general information, not legal advice. For a dispute, talk to a lawyer or your data protection authority.

What does Article 15 actually give you?

Article 15 of the GDPR gives you three things. Confirmation of whether a company processes your personal data. A copy of that data. And a set of facts about it: the purposes, the categories of data, who it has been or will be disclosed to, how long it will be kept, where it came from if not from you, and whether automated decision-making or profiling is involved, with "meaningful information about the logic involved".

Article 12 sets the terms. The first copy is free, the answer is due "without undue delay" and within one month, and the company can extend that by two further months for complex requests if it tells you why within the first month.

Article 15 never mentions AI. But "purposes" and "recipients" are exactly where model training and data licensing would have to show up. In our reading, that makes an access request the most direct legal way to ask whether your data feeds a model.

What do Spotify, SoundCloud and distributors say they give you?

Spotify is the easiest. Its privacy policy says you can use the "Download your data" tool on your Account Privacy page or contact the company. The India and UK versions say the download gives you what Spotify must provide "under Article 15 of the GDPR". Spotify's help page lists three packages. Account data covers playlists, a year of streaming history, searches, payments and inferences about your interests. Extended streaming history covers the lifetime of the account. Technical log information includes recipients the data may have been disclosed to. You get a ZIP of JSON files with "Read Me First" guides, per Spotify. The same policy says personal data is used for "development and training of algorithmic and machine learning models", including to build features such as AI DJ and AI playlist. Spotify's US policy reports 1,498,726 access requests worldwide in 2025, answered in 3.89 days on average.

SoundCloud's privacy policy (last amended 17 August 2026) says EU, EEA and UK users can request copies through the Help Center or dataprotection@soundcloud.com, and may be asked to verify their identity. Data you provided can be requested in machine-readable form. The policy mentions AI only for customer support. The AI promise sits in the Terms of Use: it will not train generative AI models "that aim to replicate or synthesize your voice, music, or likeness" without opt-in consent. Note the scope. That covers voice-cloning and music-generation models, not every kind of model.

Distributors are thinner. DistroKid's policy (effective September 2026, the version we read) takes EU and UK access and portability requests at support@distrokid.com. It lists "photos, videos or recordings, as may be captured in music content" as a personal data category, which it may share with advertising, analytics and business partners. CD Baby's policy (last updated 25 August 2025) routes access, erasure and objection requests through a web form. Neither policy, as we read them, mentions AI or machine learning at all. Silence is not a no. It is a question to ask.

We have not filed requests with these companies for this piece, so we can't tell you what their replies actually contain beyond what their own pages promise.

How do you send a request, step by step?

1. Use the self-serve tool first where there is one (Spotify). Request all packages.
2. Send a written request anyway for the parts a download doesn't cover: purposes, recipients, retention, AI use. Use the address in each privacy policy above.
3. Send it from the email on your account, and include your artist name and any account or artist ID, so identity checks are quick.
4. Diary the deadline: one month from receipt.
5. If there's no answer, follow up once, then complain to the supervisory authority in your country, a right Article 15 itself requires them to tell you about.

Template (copy and edit):

Subject: Data subject access request under Article 15 GDPR

I am writing to make a request under Article 15 GDPR. My account email is [email] and my artist name/ID is [name/ID]. Please confirm whether you process my personal data and provide: (1) a copy of all personal data you hold about me, including artist or creator account data and any recordings or metadata you treat as personal data; (2) the purposes of each processing activity, stating specifically whether any of my personal data or content is used to train, fine-tune or evaluate machine learning or AI models; (3) the recipients or categories of recipients, including any AI developers or data licensees; (4) the retention period for each category; (5) the source of any data not collected from me; (6) whether automated decision-making or profiling applies to me, with meaningful information about the logic. Please reply within one month, as Article 12(3) requires.

Checklist

• Self-serve download requested where available
• Written request sent to the address in the privacy policy
• Sent from the account email, with artist ID
• Deadline in the calendar
• Reply checked against all six points; gaps followed up in writing

What if you are in India, not the EU?

You may still be covered by the GDPR. Article 3 applies it to processing "in the context of the activities of an establishment" in the EU, "regardless of whether the processing takes place in the Union or not". Spotify's India policy names Spotify AB, in Stockholm, as controller "for the purposes of the GDPR". SoundCloud's policy says users outside the US are controlled by SoundCloud Global Limited & Co. KG in Berlin. We think that makes an Article 15 request from India entirely reasonable, though whether the GDPR binds a given company for a non-EU user is a legal question we can't settle.

India's own law is coming, but slowly. The Digital Personal Data Protection Act, 2023 gives you a right (section 11) to a summary of your personal data and the processing done on it, plus the identities of every other fiduciary and processor it has been shared with. Sections 12 to 14 add correction and erasure, grievance redressal and the right to nominate someone. The rules say companies must answer grievances within no more than 90 days, and the government's announcement says all rights requests must be answered within that limit.

The catch is timing. The commencement notification, dated 13 November 2025, brings sections 11 to 17 into force eighteen months after its Gazette publication: mid-May 2027. A January 2026 proposal to shorten that window had not been notified when an independent tracker last checked in October 2026. Until then, you can ask, but the statutory right isn't live.

There are two more limits. Section 11 applies only to companies you gave consent to. And section 3 says the Act does not apply to personal data that you yourself made publicly available. Your released tracks and public bio may fall outside it.

What we think

Access requests are some of the cheapest leverage artists have. A one-month legal deadline and a written answer about AI use beat any amount of reading terms of service.

The gap the requests expose matters most. Spotify says plainly that it trains machine learning models on personal data. SoundCloud makes a narrow, specific promise. The distributors that hold your masters, contracts and bank details say nothing. That is backwards. The companies closest to your catalogue owe you the clearest answer.

For Indian artists, the DPDP Act will help from 2027, but its public-data exclusion bites hard for people whose work is public by definition. Until then, the GDPR route through EU-based controllers is the better tool. Use it. For the next step, see our guides to do-not-train registries and opt-outs and protecting your name and likeness.