Data Subject Access Requests

The legal framework

Article 15 GDPR gives an individual the right to obtain from a controller confirmation of whether personal data about them is being processed and, if so, access to that data and to the following information:

• the purposes of the processing and the categories of data concerned;
• the recipients or categories of recipients, in particular in third countries;
• the envisaged retention period or the criteria used to determine it;
• the existence of the rights to rectification, erasure, restriction and objection, and the right to complain to the authority;
• the source of the data, where not collected from the individual;
• the existence of automated decision-making, including profiling, with meaningful information about the logic involved.

The controller must also provide a copy of the personal data undergoing processing (Article 15(3)). The Court of Justice has held that a copy means a faithful and intelligible reproduction of the data, and that extracts or documents may need to be supplied where that is necessary to make the data understandable (Case C-487/21). It has also held that the individual may ask for the identity of the actual recipients, not only categories (Case C-154/21).

Deadline and format

The controller must respond without undue delay and at the latest within one month of receiving the request (Article 12(3)). The period can be extended by two further months where requests are complex or numerous, but the individual must be told of the extension and the reasons within the first month. A request made electronically is answered in a commonly used electronic form unless the individual asks otherwise.

Cost, identity and refusal

The first copy is free. A reasonable fee based on administrative costs may be charged for further copies (Article 15(3)). If the controller has reasonable doubts about identity, it may request additional information (Article 12(6)), but it should not collect more than it needs. It may refuse or charge a fee where requests are manifestly unfounded or excessive, in particular because of repetition, and it bears the burden of showing that (Article 12(5)). The right of access may not adversely affect the rights and freedoms of others (Article 15(4)), which is the legal basis for redacting third-party data. Other limits come from national law, such as legal professional privilege and secrecy duties.

A request does not have to name Article 15 or use a form. A written message that asks what data you hold is enough, whichever channel it arrives through.

In practice

An online retailer receives an email from a former customer: "Please send me everything you have about me." The email arrives on 3 March in a general inbox and is forwarded to the privacy contact two days later. The one-month period started on 3 March.

The retailer checks the identity by matching the email address with the customer account, without asking for an ID card. It searches the shop system, the newsletter tool, the customer-service tickets, the payment provider and the delivery partner. It finds order history, support chats, marketing preferences and a fraud score. It provides these in a structured file with the information in Article 15(1): purposes, recipients such as the payment provider and the carrier, and retention periods. It leaves out the internal notes of a colleague that mention another customer, and redacts the name of that customer in the support chat. The fraud scoring raises the question of whether details about the logic can be given without revealing security measures, which the lawyer decides case by case.

Had the customer also asked for deletion, the retailer would have kept the invoices for the period required by accounting and tax law and deleted the rest, and would have told the customer so.

Processes that work

Requests succeed or fail on process: one intake point for all channels, a log with the date of receipt, a list of systems to search, a standard response structure and a person who approves. Our request handling function is built around this, and your record of processing gives much of the information for Article 15(1).

Frequently asked questions

Can we ask why the person wants the data?

No. The individual does not need to give a reason. A request made in the context of a dispute is still a valid request, unless it is abusive in the narrow sense of Article 12(5).

Does the one-month period stop if we ask for ID?

Not automatically. You should ask promptly, and the period can reasonably be treated as running from when you have the information needed to identify the person, but you cannot use the request for ID to gain time.

Do we have to search emails and backups?

Personal data in emails is in scope. Backups are in scope in principle, but the effort required and the purpose of the request may justify a more targeted search. Document the choices you make.

What can we do about a flood of requests?

Extend by up to two months if requests are complex or numerous, and notify the person. Refusal for excessive requests is possible but needs a documented basis.

How this connects

Handling requests is part of DPO as a Service. The entries in your register and your retention schedule determine how quickly you can answer, and requests can be tracked in the client portal.