The right of access is a data subject right that allows an individual to confirm whether an organization processes their personal data and, if it does, to obtain a copy of that data together with key information about how it is used. Under the GDPR it is set out in Article 15, and a request made under it is commonly called a data subject access request, or DSAR.
Among user rights in privacy law, access is the gateway right. People usually cannot exercise erasure, rectification, objection or data portability effectively until they know what data exists and where it came from, so access requests often come first.
What the right of access covers
The right of access has three layers: confirmation that processing takes place, a copy of the personal data and supplementary information about the processing. A response that delivers only a data export, or only a summary of categories, is incomplete.
The supplementary information mirrors the content of a privacy notice but must be specific to the requester rather than generic. The table lists the elements a controller must provide.
| Element | What the controller must state |
|---|---|
| Purposes | Why the person’s data is processed |
| Categories of data | Types of personal data concerned |
| Recipients | Who received or will receive the data, including third countries |
| Retention period | How long data is kept or the criteria used |
| Other rights | Rectification, erasure, restriction, objection and complaint to an authority |
| Source | Where the data came from if not collected from the person |
| Automated decisions | Existence of profiling, the logic involved and its consequences |
| Transfer safeguards | Protections used for transfers outside the EEA |
“Personal data” is interpreted broadly. It includes not only database fields but also emails, chat messages, call recordings, log entries, notes and opinions about the person, as long as they relate to that individual. The copy must be intelligible, so internal codes may need explanation.
Deadlines, fees and verification
A controller must respond without undue delay and within one month of receiving the request. The period can be extended by two further months for complex or numerous requests, but the person must be told about the extension and the reason within the first month.
| Parameter | Rule | Practical note |
|---|---|---|
| Response time | One month from receipt | Starts when the request arrives, not when it is logged |
| Extension | Up to two additional months | Only for complexity or volume |
| Fee | Free for the first copy | Reasonable fee for further copies or unfounded requests |
| Format | Commonly used electronic form if requested electronically | Secure portal or encrypted file |
| Identity check | Proportionate verification | Ask only what is needed to confirm identity |
The request needs no special form or wording and no reason. A message to a customer service address or a social media account can be a valid request. Identity verification must be proportionate: requesting a passport copy from someone who is already logged into their account is usually excessive.
Right of access compared with related user rights
Access is closely related to other user rights, but each serves a distinct goal. Access is about transparency and verification, not about moving or removing data.
| Right | Main goal | Scope of data | Output |
|---|---|---|---|
| Right of access | Know what is processed and how | All personal data about the person | Copy plus explanation |
| Data portability | Reuse data with another service | Data provided by the person, under consent or contract | Structured machine-readable file |
| Right to erasure | Remove data | Data without a continuing legal ground | Deletion confirmation |
| Consent withdrawal | Stop consent-based processing | Processing based on consent | End of that processing |
Access is broader than portability in scope but less strict in format. A portability export may be a subset of what an access response must contain.
Limits and exemptions
The right is strong but not absolute. The copy must not adversely affect the rights and freedoms of others, so personal data of third parties, such as colleagues named in emails, may need redaction. Trade secrets and intellectual property can justify withholding specific content, but not refusing the entire request.
- Manifestly unfounded or excessive requests may be refused or charged for, but the controller bears the burden of proof.
- Repetitive requests at short intervals can be excessive when nothing has changed.
- National exemptions may cover legal privilege, crime prevention or regulatory functions.
- A motive such as litigation does not make a request abusive in itself.
Handling access requests in practice
Organizations that handle access requests well treat them as a repeatable process, not a one-off search. The core requirement is a current data inventory that shows which systems hold personal data and how to search them by identifier.
- Log the request and record the deadline on the day of receipt.
- Verify identity proportionately and clarify scope only if genuinely needed.
- Search every system in the data map, including backups in active use, email and support tools.
- Review and redact third-party data and legally protected content.
- Assemble the copy and the supplementary information, then deliver it securely.
- Keep a record of what was provided and when.
The most frequent failures are missed deadlines, incomplete searches that ignore unstructured data and responses that list categories instead of providing the actual data.
Stripped to the essentials
The right of access means you can ask any organization, “Do you have information about me, and what is it?” and they must answer. If they hold data about you, they must give you a copy and explain why they have it, who they shared it with and how long they will keep it.
It is like asking to see the file a company keeps on you. You do not need to give a reason, and the first copy is free of charge. In most cases the answer must arrive within one month.
Where it is applied
A former employee of a logistics company suspects that a negative performance note influenced a reference given to a new employer. She sends a short email to the human resources address asking for all personal data the company holds about her.
The company logs the request, confirms her identity through her known private email address and searches the HR system, payroll, the ticketing tool and the mailboxes of her two former managers. It redacts the names and opinions of colleagues who are not the subject of the request, but provides the performance note, the internal email thread about the reference and an explanation of retention periods.
The response is delivered as an encrypted archive on day twenty-six. With the copy in hand, she uses her right to rectification to add her own statement to the note, and the matter is resolved without a complaint to the supervisory authority.