Article 15 — Right of Access by the Data Subject to Their Data

Legal Provision

Right of access by the data subject to their data: establishes the data subject right to obtain confirmation of processing, access to their personal data and detailed information about the processing activities.

Scope

Applies to entities processing personal data: data controllers.

Requirement type

Duty: the data controller must grant the data subject the right to access/ receive their personal data.

Actions to demonstrate compliance

A. Binary (yes/no)

• Established communication channels for submitting requests (electronic, written).
• Documented procedures for responding to requests, including reasons for refusals or delays.
• Logs of received access requests and responses provided.

B. Non-binary (requires contextual assessments)

• Verification that requests clearly concern personal data of the requesting individual
• Information provided is complete, concise, transparent, intelligible, and easily accessible, using clear language
• Adequate explanations when providing raw or coded data to ensure the data subject’s understanding.
• Tailored explanations for information related to automated decision-making, profiling, data transfers outside the EU, and other complex processing operations.
• Balancing tests conducted and documented when access requests involve personal data affecting third-party rights, clearly justifying any rejections or omissions.
• Balanced documentation of considerations regarding ‘manifestly unfounded’ or ‘excessive’ requests, including proportionality and reasons for refusing or charging fees.
• Justified time extensions documented and communicated transparently to data subjects when responding to complex or numerous requests.

Monitoring requirement

• Periodic audits and reviews of request handling processes and logs.
• Verification of response completeness, accuracy, and clarity.
• Continuous review and improvement of internal communication and handling protocols for data subject requests.

Consequences of non-compliance

• Fines up to €20 million or 4% of global turnover.
• Legal claims and complaints from data subjects.
• Regulatory scrutiny, investigation, and potential enforcement actions by supervisory authorities.
• Reputational harm and loss of public trust.
• Mandatory corrective measures imposed by supervisory authorities.