GDPR Article 15: what is the right of access by the data subject?

Article 15 is the most requested right in the GDPR and the one most often answered incompletely. The usual failure is not refusal. It is a controller exporting the data, attaching it to a polite email, and never addressing the eight items the article actually lists alongside the data.

Those items are the substance of the article. The copy is one subsection out of four.

The two limbs of Article 15(1)

Article 15(1) reads that the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information.

So the first limb is a yes-or-no answer, owed even where the answer is no. A controller holding nothing still owes the confirmation.

The second limb is access to the data together with the eight points that follow.

The eight items in Article 15(1)(a) to (h)

Point (a) is the purposes of the processing.

Point (b) is the categories of personal data concerned.

Point (c) is the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations.

Point (d) is, where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.

Point (e) is the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing.

Point (f) is the right to lodge a complaint with a supervisory authority.

Point (g) is, where the personal data are not collected from the data subject, any available information as to their source.

Point (h) is the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Points (g) and (h) are the two that most commonly go unanswered, and they are the two a data subject is most likely to press on, because they describe things the person cannot discover from the export itself. Point (g) asks where data the person never handed over came from. Point (h) asks what a system decided about them and on what reasoning.

Article 15(2): transfers

Where personal data are transferred to a third country or to an international organisation, Article 15(2) gives the data subject the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

This is a separate disclosure from point (c). Point (c) names recipients; Article 15(2) explains the legal mechanism protecting the transfer. A controller using a US sub-processor under standard contractual clauses owes both: the recipient category, and the fact that Article 46 safeguards are in place.

Article 15(3): the copy, and when a fee is allowed

Article 15(3) provides that the controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

The fee permission is narrow and attaches only to further copies. The first copy is free, and the format default for an electronic request is a commonly used electronic form.

Article 15(4): the limit that governs third-party data

Article 15(4) states that the right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

This is the provision that handles the practical problem in almost every real request: the records containing the requester's data also contain someone else's. A support thread names another customer. An internal email discusses two employees. Article 15(4) does not permit a blanket refusal on that basis, because it limits the copy right rather than extinguishing the access right, and it is directed at adverse effects on others rather than at inconvenience to the controller. Redaction of the third-party material, with the requester's own data released, is the ordinary outcome.

Article 15 and Article 20 are not the same right

The overlap with data portability causes persistent confusion, and the two articles are built differently.

Article 15 reaches all personal data concerning the person, whatever the lawful basis, and its purpose is transparency. Article 20 reaches only data the person provided, only where processing rests on consent or a contract and is carried out by automated means, and its purpose is reuse, which is why it carries the structured, commonly used and machine-readable format requirement that Article 15 does not.

A readable report can answer an access request. It cannot answer a portability request.

Timing sits in Article 12

Article 15 sets no deadline of its own. The clock is in Article 12(3), which requires the controller to provide information on action taken without undue delay and in any event within one month of receipt, extendable by two further months where necessary taking into account the complexity and number of requests, with the data subject informed of the extension and its reasons within one month.

That is why a controller cannot treat the eight items as optional extras to be sent later. They are part of the response owed inside the same period as the data.