Right of Access under Article 15 GDPR
What is the Right of Access?
The Right of Access is regulated in Article 15 of the General Data Protection Regulation (GDPR). It allows data subjects to request confirmation from controllers as to whether personal data is being processed. If so, they have the right to access this data and certain information about it.
Scope of the Right of Access
The right of access includes, in particular, the following information:
- Purpose of processing
- Categories of personal data processed
- Recipients or categories of recipients to whom the data has been disclosed
- Planned storage duration or criteria for determining this duration
- Other rights of the data subject (rectification, erasure, restriction, objection)
- Right to lodge a complaint with a supervisory authority
- Source of the data, if not obtained directly from the data subject
- Existence of automated decision-making, including profiling
Data subjects also have the right to receive a copy of the processed data. Additional copies may be requested for a reasonable fee.
How Can Data Subjects Exercise the Right of Access?
Data subjects can exercise the right of access in writing, electronically, or orally. In practice, this is usually done through a formal access request via email or letter.
The controller must respond to the request within one month. In exceptional cases, this period may be extended by up to two months.
The access information must be provided in a precise, transparent, intelligible, and easily accessible form, in accordance with Article 12(1) GDPR.
