Article 15 of the GDPR: Right of Access of the Data Subject

· By Bertrand BucelleBertrand Bucelle · 2 min read

Article 15 of the GDPR: Right of Access of the Data Subject

Article 15 of the GDPR Explained

The data subject has the right to obtain from the data controller:

  • Confirmation as to whether or not personal data concerning them is being processed;
  • Access to such data;
  • And the following information:
    • Purposes of the processing,
    • Categories of personal data concerned,
    • Recipients or categories of recipients,
    • Envisaged retention period,
    • Existence of the rights to rectification, erasure, restriction of processing or objection,
    • The right to lodge a complaint with a supervisory authority,
    • Source of the data (if not collected from the data subject),
    • Existence of automated decision-making.

The individual may also request a free copy of their data (in electronic format for an online request).

Why This Article Is Important for Your GDPR Compliance

The right of access is one of the most commonly requested by individuals. Failure to respond within the stipulated timeframe or to provide incomplete responses exposes organisations to significant sanctions. It is a key indicator of GDPR maturity for any organisation processing personal data.

How to Comply with Article 15 of the GDPR?

  • Implement an internal procedure for managing access requests, with the designation of a responsible person (DPO or other).
  • Maintain a register of requests received and responses provided.
  • Provide a response within one month, unless justified by complexity.
  • Prepare a response template with all required information.

Examples of application of Article 15 of the GDPR

  • A client of a healthcare service requests access to their medical record: the establishment provides them with a secure copy within 30 days.
  • An employee requests to know which HR data pertains to them: the company provides a file comprising payslips, evaluations, and time sheets.
  • An online platform allows users to directly download their data from their account.

Related Resources

Accelerate Your Compliance in a Few Clicks

Thanks to our all-in-one solution, you can accelerate and ensure your compliance easily:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise your teams' awareness with our GDPR training e-learning

👉 Request a demo with an expert

⚡ Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.
👉 GDPR: Self-assess now