Right of Access (Article 15 GDPR)
Every data subject's right to information + a copy of their data
TL;DR
Under Article 15 GDPR, every data subject has the right to obtain from the controller confirmation as to whether their personal data are being processed — and, if so, information on the purposes, categories of data, recipients and storage period, plus a copy of the data. Deadline: 1 month (extendable to 3).
What is the right of access (Article 15 GDPR)?
The mandatory information covers (Article 15(1)):
- Purposes of processing
- Categories of personal data
- Recipients or categories of recipient
- Storage period or the criteria for it
- Existence of the right to rectification / erasure
- Right to lodge a complaint with the supervisory authority
- Source of the data
- Automated decision-making (Article 22) — including the 'meaningful logic' involved in ADM
Practical example
CJEU C-203/22 (Dun & Bradstreet, 02/2025): in the case of algorithmic decisions, the 'logic involved' must be capable of being explained. The consequence: black-box algorithms are problematic.
Frequently asked questions
Do I have to provide the information free of charge?
How quickly must I respond?
Information to the accused person in HinSchG proceedings?
Germany: Restricted under § 29 of the German Federal Data Protection Act (BDSG) — the identity of the whistleblower may not be disclosed.
Austria: § 29 BDSG does not apply here (the BDSG is German law). Protection of the whistleblower's identity follows from the confidentiality provision in § 7 of the Austrian Whistleblower Protection Act (HSchG); any restrictions on access are governed by the Austrian Data Protection Act (DSG) rather than by the BDSG. The competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18 DSG).