Article 15 GDPR : Modalities of the Right of Access and Delivery of Data Copy

Scope of the Right of Access and Right to a Copy (Art. 15.1 & 15.3 GDPR)

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and comprehensive statutory information (purposes, categories of data, recipients, storage periods, existence of rights to rectification/erasure, and right to lodge a complaint).

The controller shall provide a free first copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

Disclosure of Specific Recipients (CJEU Judgment C-154/21)

In its landmark ruling of 12 January 2023 (Österreichische Post, C-154/21, ECLI:EU:C:2023:3), the Court of Justice of the European Union held that where personal data have been or will be disclosed to recipients, Article 15(1)(c) requires the controller to provide the data subject with the specific identity of those recipients.

The controller is only permitted to refer to general categories of recipients if it is materially impossible to identify the specific recipients, or if it demonstrates that the request is manifestly unfounded or excessive.

Response Timeframes and Lawful Extension (Art. 12.3 GDPR)

The controller shall provide information on action taken on a request under Article 15 without undue delay and in any event within one month of receipt of the request.

That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller must inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

Verified Official Sources

See Also in the Legal Framework