--- title: "Data Subject Access Requests | Pitch" description: "How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains." url: https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy) # Data Subject Access Requests How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework Article 15 GDPR gives an individual the right to obtain from a controller confirmation of whether personal data about them is being processed and, if so, access to that data and to the following information: - the purposes of the processing and the categories of data concerned; - the recipients or categories of recipients, in particular in third countries; - the envisaged retention period or the criteria used to determine it; - the existence of the rights to rectification, erasure, restriction and objection, and the right to complain to the authority; - the source of the data, where not collected from the individual; - the existence of automated decision-making, including profiling, with meaningful information about the logic involved. The controller must also provide a copy of the personal data undergoing processing (Article 15(3)). The Court of Justice has held that a copy means a faithful and intelligible reproduction of the data, and that extracts or documents may need to be supplied where that is necessary to make the data understandable (Case C-487/21). It has also held that the individual may ask for the identity of the actual recipients, not only categories (Case C-154/21). ### Deadline and format The controller must respond without undue delay and at the latest within one month of receiving the request (Article 12(3)). The period can be extended by two further months where requests are complex or numerous, but the individual must be told of the extension and the reasons within the first month. A request made electronically is answered in a commonly used electronic form unless the individual asks otherwise. ### Cost, identity and refusal The first copy is free. A reasonable fee based on administrative costs may be charged for further copies (Article 15(3)). If the controller has reasonable doubts about identity, it may request additional information (Article 12(6)), but it should not collect more than it needs. It may refuse or charge a fee where requests are manifestly unfounded or excessive, in particular because of repetition, and it bears the burden of showing that (Article 12(5)). The right of access may not adversely affect the rights and freedoms of others (Article 15(4)), which is the legal basis for redacting third-party data. Other limits come from national law, such as legal professional privilege and secrecy duties. A request does not have to name Article 15 or use a form. A written message that asks what data you hold is enough, whichever channel it arrives through. ## In practice An online retailer receives an email from a former customer: "Please send me everything you have about me." The email arrives on 3 March in a general inbox and is forwarded to the privacy contact two days later. The one-month period started on 3 March. The retailer checks the identity by matching the email address with the customer account, without asking for an ID card. It searches the shop system, the newsletter tool, the customer-service tickets, the payment provider and the delivery partner. It finds order history, support chats, marketing preferences and a fraud score. It provides these in a structured file with the information in Article 15(1): purposes, recipients such as the payment provider and the carrier, and retention periods. It leaves out the internal notes of a colleague that mention another customer, and redacts the name of that customer in the support chat. The fraud scoring raises the question of whether details about the logic can be given without revealing security measures, which the lawyer decides case by case. Had the customer also asked for deletion, the retailer would have kept the invoices for the period required by accounting and tax law and deleted the rest, and would have told the customer so. ### Processes that work Requests succeed or fail on process: one intake point for all channels, a log with the date of receipt, a list of systems to search, a standard response structure and a person who approves. [Our request handling function](https://www.pitch.law/technologies/dsar-handling) is built around this, and your [record of processing](https://www.pitch.law/technologies/privacy-register) gives much of the information for Article 15(1). ## Frequently asked questions ### Can we ask why the person wants the data? No. The individual does not need to give a reason. A request made in the context of a dispute is still a valid request, unless it is abusive in the narrow sense of Article 12(5). ### Does the one-month period stop if we ask for ID? Not automatically. You should ask promptly, and the period can reasonably be treated as running from when you have the information needed to identify the person, but you cannot use the request for ID to gain time. ### Do we have to search emails and backups? Personal data in emails is in scope. Backups are in scope in principle, but the effort required and the purpose of the request may justify a more targeted search. Document the choices you make. ### What can we do about a flood of requests? Extend by up to two months if requests are complex or numerous, and notify the person. Refusal for excessive requests is possible but needs a documented basis. ## How this connects Handling requests is part of [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service). The entries in your [register](https://www.pitch.law/technologies/privacy-register) and your [retention schedule](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) determine how quickly you can answer, and requests can be tracked in the [client portal](https://www.pitch.law/technologies/client-portal). ## In short - Content of the right of access (Article 15) - One-month deadline and extension - When you may refuse or redact ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) ## Technology we use - [Technology](https://www.pitch.law/technologies/dsar-handling) ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/client-portal) ### [Client Portal](https://www.pitch.law/technologies/client-portal) [A secure place where you follow your matters, instruct us on deadlines, work on registers with us and see your IP portfolio, in the same environment as our work.](https://www.pitch.law/technologies/client-portal) ## More in Privacy & Data Protection - ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [How Long May You Keep Personal Data?](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice.](https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) - ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)