To: privacy@tesla.com
Subject: Data subject access request under Articles 15 and 22 GDPR — VIN [YOUR VIN]

Dear Tesla Data Protection Office,

I am the owner of the vehicle below and the data subject in respect of the data associated with my Tesla Account. I make the following request under Regulation (EU) 2016/679 (GDPR).

- Name: [FULL NAME]
- Tesla Account email: [EMAIL ON THE ACCOUNT]
- Vehicle: [MODEL], VIN [VIN]
- Country of residence: [COUNTRY]

Background. On or around [DATE], Full Self-Driving and/or other driver assistance functionality on my vehicle was remotely disabled. I received a notification stating that my vehicle had “detected an unauthorized third-party device”. I did not consent to the removal of functionality I had purchased, and I have received no explanation of the data or reasoning behind that decision.

1. PRESERVATION

Before anything else: please preserve, and do not delete, alter or allow to be overwritten by any routine retention process, all data relating to VIN [VIN] for the period [ONE MONTH BEFORE THE DATE] to [ONE MONTH AFTER THE DATE], and all records relating to the decision to disable functionality on my vehicle. Please confirm in writing that this has been done. I am aware that your customer-facing export appears to cover only a limited recent period, and I ask you to distinguish clearly between what your export tool produces and what Tesla actually retains.

2. DATA REQUESTED

Please provide a copy of the following personal data (Article 15(1) and 15(3)):

1. All telemetry, diagnostic and event data recorded, transmitted or held in respect of VIN [VIN] that Tesla used, referenced or relied upon to detect the alleged unauthorised third-party device, and to disable functionality.
2. The specific date(s) and time(s) at which that data was collected, transmitted to Tesla, and processed for that purpose.
3. All records of the change itself: the entitlement, licence, configuration or feature-flag records for my vehicle before and after the change, and the log of the change being applied.
4. In particular, the recorded values for the following signals for the period at 1 above — these are the field names Tesla itself uses in its customer data exports:

   * State of Self-Driving features
   * Driver Monitoring Detection for Self-Driving features
   * UI Setting - Autosteer and UI Setting - Navigate on Autosteer
   * Bluetooth Device 0 Status, and the equivalent fields for devices 1 to 3

5. Any internal ticket, case, work order, engineering record or communication concerning my vehicle and this decision, including who authorised it.
6. All service communications concerning my vehicle, including in-app messages, SMS and email logs.

3. INFORMATION REQUESTED

Please also provide, under Article 15(1):

- (c) the recipients or categories of recipients to whom this data has been or will be disclosed, including any recipient outside the EU/EEA;
- (d) the retention period applied to each category of data at 2 above, and confirmation of whether each is still held;
- (h) the existence of automated decision-making, and meaningful information about the logic involved, together with the significance and envisaged consequences for me.

On the last point, I am aware of the judgment of the Court of Justice in Case C-203/22 (CK v Dun & Bradstreet Austria, 27 February 2025), in which the Court held that Article 15(1)(h) requires the controller to explain the procedure and principles actually applied to reach the specific result, in a concise and intelligible form, and that a claim of trade secrecy does not justify a blanket refusal.

4. AUTOMATED DECISION-MAKING — ARTICLE 22

The disablement appears to have been an automated decision that significantly affects me: I have permanently lost functionality I paid [AMOUNT] for, with no refund and no restoration. I therefore request, under Article 22(3):

1. Human intervention — a review of this decision by a person with authority to reverse it, not a restatement of the outcome;
2. The opportunity to express my point of view, which I do by this letter;
3. The means to contest the decision.

Please also state which condition in Article 22(2) Tesla relies upon in taking the decision, and identify the specific criteria by which a device is classified as “unauthorised”.

5. QUESTIONS ABOUT YOUR EXPORT PROCESS

1. Is the period covered by your customer data export a retention period, or only a limit on what the export tool produces?
2. If it is only an export limit, what is the actual retention period for vehicle telemetry associated with a VIN, and how do I obtain data older than the export window?
3. By what technical means was the alleged third-party device detected, and via which signal or data channel?

6. DEADLINE AND FORMALITIES

I look forward to your response within one month, as required by Article 12(3). If you consider an extension necessary, please note that Article 12(3) requires you to inform me of that extension and of the reasons for it within that same one-month period, and to state the specific date by which you will respond. An extension notified after the month has expired is not effective.

If you decline any part of this request, Article 12(4) requires you to inform me of the reasons, and of my right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

Please provide the data in a commonly used electronic format under Article 15(3). Please confirm receipt of this request and the date from which you are calculating the one-month period.

I reserve my rights under Articles 77 and 79 GDPR.

Yours faithfully,
[FULL NAME]
[DATE]