Data subject rights and access

The request generally does not have to state a reason. A short message may be sufficient if it shows that a person wants to know whether and which personal data concerning them is being processed. The company should therefore record the substance of the message and its date of receipt, rather than relying only on the subject line.

Four questions help with the first classification: Who made the request? What role does the person have in the company or customer relationship? Which processing activities may be relevant? And which entity decides the purposes and means of processing? The controller must organise the response. A processor can assist with the search but does not replace the controller’s responsibility.

The controller must facilitate the exercise of data subject rights. Additional evidence should therefore not be requested as a routine formality. If there are reasonable doubts about identity, however, the controller may request further information necessary to confirm it. The type and extent of the check must match the risk of the processing.

For an existing customer account, verified contact details or a secure login may be sufficient. For particularly sensitive data or a request from an unknown address, an additional proportionate confirmation may be necessary. A blanket request for an identity document in every case is not a substitute for a risk-based decision. The check and its reasons should be recorded.

The response must be more than a statement that data is stored. Article 15 GDPR requires, in addition to the personal data, information on the purposes of processing, categories of personal data, recipients or categories of recipients, the storage period or the criteria used to determine it, the other data subject rights and the right to lodge a complaint with a supervisory authority.

If the data was not collected directly from the data subject, the available information on its source must also be included. Where automated decision-making, including profiling, is involved, the legally required information about the logic involved and the envisaged effects must be considered. For transfers to third countries, the appropriate safeguards must be identified.

The information must be provided in an intelligible form. An unexplained system extract may therefore be insufficient if the person cannot understand the processing or the allocation of the data. At the same time, the right of access is not a blanket right to every internal business document. The relevant personal data and the information required by law must be provided in a complete and comprehensible way.

The controller must provide information on the measures taken without undue delay and at the latest within one month of receiving the request. The period may be extended by up to two further months where necessary because of the complexity or number of requests. The data subject must be informed of the extension and the reasons for it within the first month.

If the company takes no action, it must also explain the reasons at the latest within one month and inform the data subject about the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy. A deadline calendar with responsibility, interim checks and recorded dispatch helps prevent a response from being assembled at the last moment.

The first copy of the personal data is generally free of charge. For further copies, a reasonable fee based on administrative costs may be charged under the statutory conditions. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee or refuse to act. The company must be able to substantiate the conditions for that decision.

If the request is made electronically, the information should be provided in a commonly used electronic form where possible, unless the data subject asks otherwise. Access may also be limited where the rights and freedoms of other people, trade or business secrets or specific statutory protections are affected. These limits require a concrete assessment. A blanket refusal of the entire request is not a substitute for that assessment, and the remaining information must still be provided.

A good response is usually prepared before the final letter is drafted. Businesses should define who receives requests, which systems and processors are queried, who assesses the results and who approves the final response. The internal search should remain traceable without collecting more personal data than necessary for the request.

The file should record at least receipt and the deadline calculation, the identity check, the systems and teams queried, the data categories found, the review of recipients and storage periods, any redactions or limits, an extension with reasons and the dispatch of the response. You can use the access request checklist for the individual steps. The role check can help where responsibilities are unclear. The organisational framework is covered in privacy compliance and governance.