Right of access
Under Article 15 GDPR, the right of access allows data subjects to obtain their personal data and important information about how it is processed.
The right of access under Article 15 GDPR allows a data subject to ask a controller to confirm whether personal data concerning them is being processed. If it is, the response must provide access to that data and information about the purposes, categories of data, recipients, storage period or the criteria used to determine it, together with other information required by law.
The right generally includes a copy of the personal data. The request does not have to state reasons. The controller must respond without undue delay and, in any event, within one month of receiving the request. Where the request is complex or numerous, the period may be extended by two further months; the data subject must be informed of the extension and its reasons within the first month. If there are justified doubts about identity, additional information may be requested where this is proportionate.
The right of access is not the same as a general civil-law claim for an accounting or disclosure of files. The copy must not adversely affect the rights and freedoms of other people. For businesses, reliable handling includes a traceable intake channel, proportionate identity checks, searches across relevant systems and documentation of the response. The overview of data subject rights and access explains the wider context, while the access-request checklist supports the process.
General orientation, not individual advice.
-
Personal data
Any information relating to an identified or identifiable natural person, such as a name, customer number, location data or an online identifier.
-
Data subject
The natural person to whom personal data relate and who is therefore affected by the processing under data protection law.
-
Processing
Any operation performed on personal data, including collection, storage, use, disclosure, restriction, erasure or destruction.
-
Transparency and information duty
Under the GDPR, the information duty requires controllers to explain clearly how and why they process personal data.
-
Right to rectification
The right to rectification under Article 16 GDPR allows data subjects to obtain without undue delay the correction of inaccurate personal data and the completion of incomplete data.
Discuss your data protection matter
Tell us briefly what is happening. We will help classify the situation and discuss which documents and next step are useful for your business.
Clarify a data protection question
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg Österreich
Phone
+43 662 6280000