Access requests under Art. 15 GDPR
The right of access reaches further than most expect, but not without limit. The one-month deadline applies to the substantive answer, not to an acknowledgement of receipt.
Access requests rarely come on their own. They frequently sit at the start of an employment dispute or a disagreement with a customer. That does not change the right, but it does change the care with which the answer should be prepared.
How we proceed
Step 1: Settle identity and start of the deadline
Who is asking, and when does the month start? Where there are reasonable doubts about identity you may request further information, but that does not postpone the start indefinitely.
Step 2: Determine the scope
Which systems process data on this person? The search belongs across all systems, not only the obvious one.
Step 3: Check the limits
Third-party rights, trade secrets and the question of what in a document is actually personal data.
Step 4: Answer and document
The response goes out on time, and whatever is withheld is reasoned and recorded.
What has to be disclosed and what does not
Belongs in the response
- The personal data processed itself
- Purposes, categories, recipients and envisaged retention period
- The source of the data where it was not collected from the person
- A reference to data subject rights and the right to complain
Sets limits
- Rights and freedoms of other people, for instance in correspondence
- Trade secrets and protected internal business information
- Internal assessments, in so far as they are not personal data
- Every withholding needs reasons and belongs on the record
How we support you
We determine the scope with you, draft the response and give reasons for what is withheld. Where an employment or civil dispute is running in parallel, we align the answer with that line rather than handling it in isolation.
A request on the table and a deadline running?
We settle the scope before the month is up.
Get in touchFrequently asked questions
How long do we have to respond?
One month from receipt. Where the request is particularly complex or numerous, an extension of two further months is possible, but you have to say so within the first month. The deadline applies to the substantive answer. A mere acknowledgement does not meet it.
Do we have to hand over every email?
Not across the board. The right covers the personal data processed together with information on purposes, recipients and retention, not every document in which a name appears. Where a copy is demanded, you have to work out what of it is actually the requester personal data and where third-party rights stand in the way.
Does a claim follow the access request?
Often enough it does, which is the reason to build the answer carefully. The access request supplies the facts on which a claim under Article 82 GDPR is later based, and a late or incomplete answer is itself a breach. Anyone missing the deadline supplies the first building block. What follows from a claim under Article 82 GDPR is set out under damages under Article 82 GDPR.
The request clearly comes out of a dismissal dispute. Does that change anything?
As a rule not the existence of the right. An extraneous motive does not automatically make a request abusive, and refusing on that basis is risky. It is more sensible to determine the scope properly and answer on time.