The right of access entitles every person to obtain confirmation from a controller as to whether, and which, personal data concerning them is being processed.
Scope of the information
The information covers the data processed itself and, among other things, the purposes of processing, the categories of data, the recipients, the envisaged retention period, the source of the data and the existence of other data subject rights.
In addition, the data subject is entitled to a copy of the data. According to the CJEU (judgment of 4 May 2023, C-487/21), this means a faithful and intelligible reproduction, which in individual cases may also include extracts from documents.
Deadlines and form
The information must be provided without undue delay and at the latest within one month. For complex or numerous requests, the deadline can be extended by a further two months, in which case the person must be informed within the first month.
The first copy is free of charge. Before providing the information, the controller must make sure that it is actually disclosing the data to the person entitled to it.
Legal provisions
- Art. 15 GDPR
- Right of access and right to a copy.
- Art. 12(3) GDPR
- One-month deadline and possibility of extension.
- Section 34 BDSG
- National exemptions from the right of access.
Related terms.
Right to rectification The right to rectification entitles every person to have inaccurate personal data rectified without undue delay and incomplete data completed. Art. 16 GDPR Right to erasure / erasure of personal data The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies. Art. 17 GDPR Information obligations Information obligations require controllers to inform data subjects transparently about who processes their data, for what purpose and on what basis. Art. 12 GDPR 