GDPR Article 15: Your Right of Access, Deadlines, and Remedies

The GDPR Article 15 right of access lets anyone whose personal data is processed by an organization demand a full copy of that data, along with specific information about how and why it is being used. The first copy is free, the organization has one month to respond, and the request can be as simple as a written statement that you are exercising your right of access under Article 15.

Who Can Use Article 15

The regulation’s protection depends on where you are physically located when your data is collected, not on your nationality. If you are in the European Union when a company collects or monitors your personal data, Article 15 applies regardless of whether the company itself is based in Europe.

A company with no EU establishment can still be covered if it targets people located in the EU by offering them goods or services, or monitors their behavior within the EU. A website being accessible from Europe is not enough on its own; the company needs to show some intention to reach EU-based users.

If you are a U.S. resident sitting at home in the United States, the GDPR generally does not protect you, even when the company you are dealing with is European. The exception is when the company has an EU establishment and processes your data in the context of that establishment’s activities. An American traveling in France who signs up for a service there is protected for that data collection.

What the Company Must Give You

An access request starts with a simple question: does this organization process your personal data? If the answer is yes, the controller must hand over a copy of that data plus a substantial amount of supplementary information. Under Article 15(1)(a) through (g), the controller must disclose:¹

The purposes of the processing, whether marketing, analytics, profiling, or something else.
The categories of personal data involved, from basic contact details to browsing habits or health records.
The specific recipients (or at least the categories of recipients) who have received or will receive your data, including any in countries outside the EU or in international organisations.
How long the organization plans to keep your data, or the criteria it uses to decide.
Where the data came from, if the organization didn’t collect it directly from you.

The source-of-data requirement is particularly useful for catching data brokerage practices where your information changes hands without your knowledge.

Automated Decision-Making

If the organization uses automated systems to make decisions about you, including profiling of the kind described in Article 22, it must tell you those systems exist and provide meaningful information about the logic involved and the likely consequences for you.¹ This matters most when algorithms affect credit scoring, insurance pricing, or hiring. Saying “we use AI” and leaving it there is not enough.

Your Connected Rights

The response must also inform you of your rights to request rectification or erasure of your data, to ask for processing to be restricted, and to object to processing. It must tell you about your right to lodge a complaint with a supervisory authority.¹ A good access request is often the first step toward exercising those other rights.

How to Send the Request

There is no required format. You can send an email, fill out an online form, mail a physical letter, or in some cases make the request verbally. That said, you want a paper trail. An email to the company’s data protection officer or a submission through a privacy portal gives you an immediate record of when the request was made, and the response clock starts ticking from that moment.

Most larger organizations have a dedicated privacy page with a submission form or specific email address for data requests. Using those built-in tools tends to speed things up because they feed directly into the compliance workflow. If a company has no obvious privacy contact, addressing the request to the general contact address and clearly marking it as an Article 15 request works fine. For physical mail, use registered post with tracking and keep the receipt.

What to Put in the Request

The request does not need to be elaborate. A clear written statement that you are exercising your right of access under GDPR Article 15 is the core of it. Include enough identifying information for the company to find your records: your full name, the email address associated with the account, a username, or a customer reference number from a billing statement.

You can ask for everything the company holds on you, or you can narrow the scope. If you only care about data from a specific time period or a particular service, say so. A narrower request often gets answered faster.

Some organizations will ask for identity verification before processing your request. This is legitimate; they need to make sure they are not handing your data to someone impersonating you. Common steps include confirming details from your account or providing a redacted copy of a government-issued ID.

The One-Month Deadline

Under Article 12(3), the organization must respond within one calendar month of receiving your request.² The deadline applies regardless of how much data the company processes or how busy it is.

If the request is genuinely complex, or the company is dealing with a large number of requests at once, it can extend the deadline by up to two additional months, for a total of three. The company must notify you of the extension, and the reasons for it, within the original one-month window.² Hearing nothing for a month and then getting a late extension notice is itself a compliance failure.

Verification Pauses the Clock

If the company requests identity verification, the one-month clock does not start until it receives the information it asked for.³ A company that sends a verification email on day one and waits three weeks for your response effectively gets those three weeks added to its response time. Respond to any verification request immediately.

Format and Cost

The first copy of your personal data must be provided free of charge.¹ If you ask for additional copies of the same data, the controller can charge a reasonable fee to cover administrative costs, but the GDPR does not specify a formula or cap.

When you submit your request electronically, the data should come back in a commonly used electronic format, such as CSV or PDF, unless you specifically ask for something different.¹ Article 12(1) adds that all information must be presented in a concise, transparent, and intelligible form using clear and plain language.² A raw database export with no explanation of what the fields mean arguably falls short of that standard.

One limit: providing your copy must not adversely affect the rights and freedoms of other people.¹ The company may redact other individuals’ personal data from your file, or withhold information where disclosure would genuinely harm someone else. Article 15(4) refers to the rights of other people, not the commercial interests of the company itself.

When a Company Can Refuse

Organizations cannot simply ignore access requests they find inconvenient. Article 12(5) allows a controller to refuse a request or charge a fee only when the request is “manifestly unfounded or excessive.”² The word “manifestly” is doing real work: the request must be obviously or clearly unfounded or excessive, and the burden of proof falls on the controller.

A request might qualify as manifestly unfounded if it is made with clear malicious intent: you explicitly state you are trying to disrupt the company, you are targeting a specific employee out of a personal grudge, or you offer to withdraw the request in exchange for some benefit. Aggressive language alone does not make a request unfounded.⁴

A request might be manifestly excessive if it is clearly unreasonable given the circumstances. Relevant factors include whether it largely repeats a recent request where nothing has changed, whether it overlaps with other pending requests, and the nature of the information involved. A large volume of data is not automatically excessive, and a repeat request may be perfectly reasonable if enough time has passed for the data to have changed.⁴

If a controller does refuse, it must tell you why, inform you of your right to complain to a supervisory authority, and let you know you can seek a judicial remedy. A flat refusal with no explanation is itself a violation.

If You Are Ignored or Denied

When an organization blows past the deadline or refuses your request without legitimate grounds, three escalation paths are open, and you can pursue them in parallel.

Complain to a Supervisory Authority

Every EU member state has a data protection authority (the ICO in the UK, the CNIL in France, the BfDI in Germany, and so on). Under Article 77, you can lodge a complaint with the authority in the country where you live, where you work, or where the alleged violation happened.⁵ The authority must keep you informed of the progress and outcome. This is the most common route because it costs nothing and the authority handles the investigation.

Go to Court

Article 79 gives you the right to bring legal proceedings against the controller or processor directly. You can sue in the courts of the member state where the company is established, or in the courts where you have your habitual residence.⁶ This path makes sense when you need a court order or when the supervisory authority route is moving too slowly.

Claim Compensation

If you suffered actual harm, whether financial loss or non-material damage like distress, Article 82 gives you the right to compensation. The controller is liable unless it can prove it was not responsible in any way for the event causing the damage.⁷

Fines the Company Faces

Beyond your personal remedies, the supervisory authority can impose administrative fines. Violations of data subject rights under Articles 12 through 22, which includes Article 15 access requests, fall into the higher penalty tier: up to €20 million, or 4% of the company’s total worldwide annual turnover from the preceding year, whichever is higher.⁸ That upper tier is not reserved for catastrophic breaches; it applies to any infringement of these rights, and fines for ignoring access requests have been imposed against companies of all sizes.

1
General Data Protection Regulation (GDPR). Article 15 GDPR – Right of Access by the Data Subject
2
General Data Protection Regulation (GDPR). GDPR Article 12 – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
3
Information Commissioner’s Office. What Should We Consider When Responding to a Request
4
Information Commissioner’s Office. Manifestly Unfounded and Excessive Requests
5
GDPR-Info.eu. Art. 77 GDPR – Right to Lodge a Complaint With a Supervisory Authority
6
GDPR-Info.eu. Article 79 GDPR – Right to an Effective Judicial Remedy Against a Controller or Processor
7
General Data Protection Regulation (GDPR). Art. 82 GDPR – Right to Compensation and Liability
8
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines