Subject access request under Art. 15 GDPR: how your company responds

What do you have to provide on a request under Art. 15?

According to the European Data Protection Board (EDPB), the right of access has three parts. You confirm whether you process data about the person. You give access to that data, usually as a copy, and inform them about the processing (Art. 15(1) and (3)).

That information covers purposes, categories of data, recipients, storage period, the person's rights, the right to complain, the source of the data and automated decisions (Art. 15(1)). If you transfer data to a third country, also name the safeguards for it (Art. 15(2)).

The person does not have to give a reason, and you do not check what they want the information for (EDPB). The first copy is free of charge; for further copies you may charge a reasonable fee based on administrative costs (Art. 15(3)).

Art. 15(1) to (3) GDPR

Which deadline applies, and how do you check who is asking?

You answer without undue delay and within one month of receipt at the latest (Art. 12(3)). The period starts when the request reaches you through one of your official channels, even if nobody has read it yet. The EDPB counts like this: received on 5 March, answered by 5 April at the latest.

If requests are complex or numerous, you may extend by two months, provided you say so with reasons within the first month. If you refuse, give the reasons within one month and point to the authority and the courts (Art. 12(4)).

If you have reasonable doubts about identity, you may ask for additional information (Art. 12(6)). If you ask straight away, the EDPB says the period is suspended until you have it. It generally considers a copy of an ID document unsuitable.

Art. 12(3), (4) and (6) GDPR

Where do you search, and what goes into the copy?

The request covers all data about the person unless they narrow it. The EDPB expects you to search all systems, digital and on paper, with search terms such as name and customer number. That includes emails, logs and data you have derived, such as an assessment.

What counts is the state of things on receipt. Inaccurate data belongs in the answer too; data you have already deleted under your retention rules cannot be provided. Explain codes and abbreviations.

The answer comes in a lasting form, and for a request by email in a commonly used electronic format (Art. 15(3)). According to the EDPB you may send it by email if the necessary safeguards are in place.

Art. 15(3) GDPR

When may you limit access?

The copy must not adversely affect the rights and freedoms of others (Art. 15(4)). According to the EDPB you then redact individual passages, such as a colleague's name, and hand over the rest.

You may refuse manifestly unfounded or excessive requests, or charge a fee for them (Art. 12(5)). The EDPB reads both narrowly, and the burden of proof is yours.

National law may restrict the right of access (Art. 23 GDPR), in Germany § 34 BDSG, for example for data you keep only because of statutory retention duties. Further conditions have to be met as well. You document the reasons for a refusal (§ 34(2) BDSG).

Art. 12(5) · Art. 15(4) · Art. 23 GDPR · § 34 BDSG

An example: a former employee asks

The fictional Berger Haustechnik GmbH has 90 staff and no legal department. On 5 March a fitter it dismissed a week earlier writes to its data protection address. He wants all the data about him.

The head of HR confirms receipt and gives the deadline of 5 April, as the EDPB recommends. She does not ask for ID, because the email comes from the address in his personnel file. She searches the payroll software, the time recording, the personnel file and the mailboxes.

In one performance review she redacts a colleague's name. As a recipient she names the specific tax adviser's office that runs payroll. Mistakes here would be asking for the reason because a lawsuit looms, or holding back the whole review.

With an AI assistant

An AI assistant such as Claude, ChatGPT or Copilot can prepare the answer. It compiles the information under Art. 15(1) from your record of processing activities and your privacy notice, works out the deadline and marks passages about third parties. The EDPB also names both documents as a basis that you tailor to the person.

Whether the person is who they claim to be, what you redact and whether a restriction applies is your company's decision as controller.

Giving a person's data to an assistant is itself processing; check first that a data processing agreement with its vendor is in place (Art. 28 GDPR). A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.