Every day you leave traces in dozens of databases: your bank, your mobile operator, the supermarket loyalty card, the delivery app, the gym. The right of access, set out in Article 15 of Regulation (EU) 2016/679 (GDPR), is the tool that lets you find out what those databases contain about you. It is the starting point for almost every other right: you cannot ask for data to be corrected or erased if you do not know it exists.
What you are entitled to
The right of access is not limited to a simple "yes, we hold your data". Article 15 grants you two separate things.
The first is confirmation of whether or not personal data concerning you is being processed. The second, if processing is taking place, is access to the data itself together with a set of information:
- the purposes for which the data is processed;
- the categories of data involved (identity, contact, payment, location, behavioural data);
- the recipients or categories of recipients to whom the data has been or will be disclosed, especially if they are outside the European Union;
- the envisaged retention period or, if that cannot be stated, the criteria used to determine it;
- the existence of your other rights (rectification, erasure, restriction, objection) and of the right to lodge a complaint with a supervisory authority;
- the source of the data, if it was not collected from you;
- the existence of any automated decision-making or profiling, with meaningful information about the logic involved.
You are also entitled to receive a copy of the personal data undergoing processing. The first copy is free of charge; for further copies the controller may charge a reasonable fee.
How to make the request
There is no mandatory form. You can send an email, a certified email, a registered letter or use the form many companies provide in their privacy section. A few practical precautions still help.
- Find the right recipient. The service's privacy notice lists the contact details of the data controller and, if one has been appointed, of the Data Protection Officer (DPO). Writing to that address keeps the request from getting lost in customer service.
- Identify yourself adequately. Give your name and the details that allow you to be found in their systems: account email, customer number, phone number. The controller may ask for additional information only if it has reasonable doubts about your identity.
- Cite the rule. A sentence such as "I am exercising my right of access under Article 15 of Regulation (EU) 2016/679" makes it clear this is not an ordinary commercial complaint.
- List what you want. Explicitly request a copy of the data and all the information the article provides for, so the reply cannot be reduced to an account summary.
- Keep proof of sending. The date and content of the request will matter if you need to follow up.
A concrete example
Suppose that for months you have been receiving personalised offers from an online shop where you bought something only once. With an access request you can find out whether the shop stores the history of pages you visited, whether it received your data from a business partner and which companies it passed it on to. The answer to an access request is often what reveals the source of unwanted contacts.
How long they have to reply
Article 12 GDPR requires the controller to respond without undue delay and in any event within one month of receiving the request. The deadline can be extended by two further months where the request is particularly complex or requests are numerous, but in that case the controller must inform you of the extension and the reasons within the first month.
If you made the request electronically, the information should as a rule be provided electronically, unless you ask otherwise.
When the controller can limit its answer
The right of access is not absolute. The copy of the data must not adversely affect the rights and freedoms of others: if a document also contains other people's data, the controller may redact it. Requests that are manifestly unfounded or excessive, in particular because of their repetitive character, may be refused or charged for, but the burden of proving that a request is excessive lies with the controller.
On the other hand, claiming that the data is "too much" or "spread across different systems" is not a valid excuse: organising it is the controller's job.
If you get no answer
Once the deadline has passed with no reply, or with an incomplete one, you have several options.
| Situation | What you can do |
|---|---|
| No reply within one month | Send a reminder citing the Article 12 deadline |
| Partial reply | Specify exactly which information is missing |
| Refusal without reasons | Lodge a complaint with the data protection authority |
| Damage caused by the processing | Consider seeking redress in court |
A complaint to the supervisory authority, provided for by Article 77 GDPR, can be filed directly by the data subject, without a lawyer. Attaching the original request and proof of sending makes the complaint far more effective.
In short
- Article 15 GDPR gives you the right to know whether an organisation processes your data and to receive a copy, with purposes, recipients, retention periods and source.
- The request needs no formalities: address it to the controller or the DPO, identify yourself and cite the article.
- The controller must reply within one month, extendable by two months only with reasons.
- Third parties' data can be redacted, but internal complexity does not justify a refusal.
- If you meet silence or a refusal, send a reminder and then turn to the supervisory authority.