The right of access under Article 15 GDPR enables data subjects to find out whether and which personal data concerning them is being processed by a company or public authority. In particular, it covers information about the purposes of processing, the categories of personal data, the recipients and the storage period. In addition, data subjects generally have the right to obtain a copy of the personal data being processed. The right of access serves to ensure transparency and enables data subjects to verify the lawfulness of data processing.
What information does the right of access cover?
Under Article 15(1) GDPR, data subjects may request confirmation from a company or public authority as to whether personal data concerning them is being processed.
If this is the case, they are entitled to access the personal data and, in particular, to receive the following information:
- Purposes of processing: The purposes for which the personal data is being processed.
- Categories of personal data: The categories of personal data being processed.
- Recipients: The recipients or categories of recipients to whom the data has been or will be disclosed.
- Storage period: How long the data will be stored or the criteria used to determine that period.
- Data subject rights: The rights to rectification, erasure, restriction of processing and objection.
- Source of the data: Where the personal data originated, if it was not collected from the data subject.
- Automated decision-making: Whether automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place and which information required by law must be provided in this regard.
In addition, controllers must inform data subjects of their right to lodge a complaint with a supervisory authority. Where personal data is transferred to third countries or international organisations, data subjects may also be entitled to information about the appropriate safeguards pursuant to Article 46 GDPR.
How can data subjects exercise their right of access?
Data subjects may exercise their right of access directly with the controller. As a general rule, the GDPR does not prescribe any particular form for such a request.
A request for access may therefore be submitted, for example, by email, letter or via a contact form provided by the company.
As a general rule, the request does not need to be justified. In particular, the data subject is not required to explain why they need the information.
If there are reasonable doubts about the identity of the person making the request, the controller may request additional information to confirm their identity pursuant to Article 12(6) GDPR. Only information necessary for this purpose may be requested.
Companies must establish appropriate organisational procedures to identify and process requests for access and respond to them within the applicable time limits.
How long do companies have to provide access?
Under Article 12(3) GDPR, controllers must inform data subjects of the action taken without undue delay and, in any event, within one month of receiving the request.
In the case of complex requests or a high number of requests, this period may, where necessary, be extended by a further two months.
The controller must inform the data subject of any such extension and the reasons for it within one month of receiving the request.
Under Article 12(5) GDPR, the provision of information is generally free of charge.
Are data subjects entitled to a copy of their personal data?
Under Article 15(3) GDPR, the controller must provide a copy of the personal data undergoing processing.
The right covers a complete and comprehensible reproduction of the personal data concerned. In certain circumstances, this may also require the provision of extracts from documents or entire documents.
However, there is no general right to receive all documents irrespective of whether they contain personal data concerning the data subject.
For any further copies requested, the controller may charge a reasonable fee based on administrative costs pursuant to Article 15(3) GDPR.
Where the request is made electronically, the information must generally be provided in a commonly used electronic format, unless the data subject requests otherwise.
Under Article 15(4) GDPR, the right to obtain a copy must not adversely affect the rights and freedoms of others.
When may a company refuse or restrict access?
The right of access is not unlimited. Statutory exceptions and restrictions may prevent a controller from providing full access.
These include, for example, the protection of the rights and freedoms of others, including the personal data of third parties and protected trade secrets.
The conditions set out in Article 12(5) GDPR concerning manifestly unfounded or excessive requests may also justify a refusal.
Further restrictions may arise, subject to the relevant statutory conditions, under Article 23 GDPR and supplementary national legislation.
However, a blanket refusal to provide access is not permitted. The controller must assess whether a statutory restriction actually applies and whether at least partial access can be provided.
If a request for access is not acted upon, the controller must generally inform the data subject within one month, pursuant to Article 12(4) GDPR, of the reasons for not taking action and of the available options for lodging a complaint and seeking judicial remedy.
Practical example: Access to stored customer data
A customer of an online retailer wants to find out which personal data the company has stored about them and which service providers the data has been disclosed to.
The customer therefore submits a request for access to the online retailer under Article 15 GDPR.
The company must check which personal data relating to the customer it processes. This may include, for example, contact details, order information and stored communications.
The online retailer must then provide the information required by law. This includes, in particular, the purposes of processing, the recipients of the data and the intended storage period. In addition, it must generally provide a copy of the personal data being processed.
legal data assessment: Companies should establish clear internal responsibilities and standardised procedures for handling requests for access. Particular importance should be attached to processing requests within the applicable time limits, identifying all personal data concerned and checking whether the rights of third parties may be affected. Incomplete or late responses may lead to complaints to the data protection supervisory authority and further legal consequences.
Legal basis
Articles 12, 15, 23 and 77 GDPR; in addition, in particular, Sections 27(2), 29(1) and 34 of the German Federal Data Protection Act (BDSG), where the respective statutory conditions are met.
Frequently asked questions about the right of access
Who has a right of access under the GDPR?
Under Article 15 GDPR, every data subject has the right to request information from the controller about the processing of their personal data. This applies, for example, to customers, employees and job applicants.
Is access under Article 15 GDPR free of charge?
Yes. Access to the information and the first copy of the personal data are generally free of charge. Under certain statutory conditions, for example in the case of manifestly unfounded or excessive requests, a reasonable fee may be charged.
Does a request for access need to be justified?
No. As a general rule, data subjects do not have to explain why they are requesting access to their personal data. The right of access exists irrespective of whether they have a particular interest in obtaining the information.
What happens if a company does not respond to a request for access?
If a company fails to respond within the applicable time limit, the data subject may lodge a complaint with the competent data protection supervisory authority under Article 77 GDPR. In addition, judicial remedies may be available, subject to the statutory conditions.
Can companies refuse a request for access?
Yes, if a statutory exception or restriction applies. This may be the case, for example, where requests are manifestly unfounded or excessive. Any refusal must be based on the applicable statutory requirements and must not be made on a blanket basis.
Related terms.
Right to rectification The right to rectification entitles every person to have inaccurate personal data rectified without undue delay and incomplete data completed. Art. 16 GDPR Right to erasure / erasure of personal data The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies. Art. 17 GDPR Information obligations Information obligations require controllers to inform data subjects about the processing of their personal data. The relevant legal requirements arise in particular from Articles 12 to 14 of the General Data Protection Regulation (GDPR). Companies must explain which personal data they process, for what purposes, on what legal basis and what rights data subjects have. The scope and timing of the information depend in particular on whether the data is collected directly from the data subject or obtained from other sources. 