Fiche 31/54 Part 4 — Data Subject Rights Intermediate Reviewed 2026-08-23

General Modalities for the Exercise of Rights (Art. 12)

Article 12 sets the procedural backbone for all data subject rights: transparent communication, strict one-month response deadlines, free of charge service, and reasonable identity verification safegu

Open in interactive reader

⚖️ Procedural Gateway 📋 Strict Timelines (Art. 12)

General Modalities for the Exercise of Rights (Art. 12)

⚡ In 30 seconds

Article 12 governs the exercise of all data subject rights (Articles 15 to 22). Controllers must facilitate the exercise of rights, provide communications in a concise, transparent, intelligible and easily accessible form, adhere to a strict one-month response timeline, and act free of charge.

Procedural Dimension	GDPR Standard	Operational Rule
Response Deadline	One calendar month from receipt of the request.	Extendable by up to 2 additional months where necessary, notifying user of reasons within month 1.
Financial Cost	Free of charge by default (Art. 12.5).	Reasonable administrative fee allowed only if requests are manifestly unfounded or excessive.
Identity Verification	Proportionate verification (Art. 12.6).	Ask for additional ID proof only when reasonable doubts exist regarding applicant identity.
Refusal of Action	Substantiated refusal notice (Art. 12.4).	Must state factual/legal reasons and inform of right to lodge a complaint with DPA within 1 month.

⚡ Key Takeaways

The controller bears the burden of demonstrating the manifestly unfounded or excessive character of a request.
Responses must be provided in writing or by electronic means matching the request format.
Failure to respond within one month is directly actionable before supervisory authorities and courts.

⚠️ Common Pitfall

Letting the one-month deadline elapse in silence without notifying the data subject of an extension reason.

🛠️ In Practice

Standardize email response templates that acknowledge receipt immediately and outline expected resolution steps.

⚖️ Official Sources: Art. 12 GDPR · Recitals 59–62 · EDPB Guidelines 01/2022 on Data Subject Rights ✓ Legal review: 23 August 2026