Fiche 33/54 Part 4 — Data Subject Rights Advanced Reviewed 2026-08-23

Right of Access & The Notion of Copy (Art. 15)

Article 15 guarantees individuals the right to obtain confirmation whether their data is processed, comprehensive contextual information, and a faithful, intelligible copy of all data (CJEU C-487/21).

Open in interactive reader

⚖️ Full Intelligibility 🏛️ CJEU C-487/21 Österreichische Datenschutzbehörde

Right of Access & The Notion of Copy (Art. 15)

⚡ In 30 seconds

Under Article 15, data subjects have the right to obtain from the controller confirmation as to whether personal data concerning them are being processed, access to the contextual processing metadata, and a free copy of the personal data undergoing processing (Art. 15.3). In landmark ruling C-487/21, the CJEU held that 'copy' entails a faithful and intelligible reproduction of all data.

Access Component	Content Requirements	CJEU Standards (C-487/21 & C-579/21)
Confirmation & Metadata	Purposes, recipients, retention, source origin, automated decision logic.	Must identify specific recipients where feasible, not merely broad categories (CJEU C-154/21).
The 'Copy' (Art. 15.3)	Faithful and intelligible reproduction of all processed personal data.	Includes database records, audit logs, emails authored by or referring to the person.
Contextual Documents	Full documents, forms, medical records, or contractual files.	Mandatory if contextual excerpts are essential to render the data fully understandable.

⚡ Key Takeaways

First copy is strictly free of charge; reasonable fees apply only to additional requested copies.
Access rights do not adversely affect the rights and freedoms of others (Art. 15.4, e.g. trade secrets, third-party privacy).
Access encompasses user activity logs showing who accessed their medical or financial file (Pankki, C-579/21).

⚠️ Common Pitfall

Refusing to provide copies of emails containing personal appraisals by claiming internal communications are exempt.

🛠️ In Practice

Implement an export pipeline generating human-readable PDF or HTML packages with automated third-party redaction workflows.

⚖️ Official Sources: Art. 15 GDPR · Recital 63 · CJEU C-487/21 Österreichische Datenschutzbehörde · CJEU C-154/21 RW v Österreichische Post ✓ Legal review: 23 August 2026