Do I really have to hand over every email and document in which the requester's name appears?

Paragraph 3 asks for a copy of the personal data undergoing processing, together with the information in paragraph 1. Paragraph 4 says that copy must not adversely affect the rights and freedoms of others, so data about other people or trade secrets can be a reason to leave parts out, but recital 63 warns that this must never result in refusing all information. The same recital says that where you process a large quantity of information, you may ask the requester to specify what the request relates to.

Can I charge for an access request?

Not for the first copy: paragraph 3 says you provide a copy and Article 12(5) says the handling of requests is free of charge. Where the data subject asks for further copies, you may charge a reasonable fee based on administrative costs (paragraph 3). Only for manifestly unfounded or excessive requests does Article 12(5) leave room to charge a fee or refuse, and you then have to demonstrate that.

Someone wants to know how our system automatically assessed their application. What do I have to provide?

Paragraph 1(h) gives the data subject the right to information about the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and at least in those cases to meaningful information about the logic involved, the significance and the envisaged consequences. Recital 63 mentions trade secrets and the intellectual property in software as interests to weigh, but also says this must not result in the data subject being refused all information.

Article 15: Right of access by the data subjectAI-relevant

Praxikon tracks Article 15 (Right of access by the data subject) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 15 gives everyone the right to ask an organisation whether it processes personal data about them and, if so, to access those data. That access comes with explanation: the purposes, the categories of data, the recipients, the retention period, the data subject's rights, the right to complain, the source where the data did not come from the person, and the existence of automated decision-making with meaningful information about the logic (paragraph 1). For transfers to a country outside the EU, the data subject is told which safeguards apply (paragraph 2). The organisation provides a copy of the data; the first copy is free and an electronic request is answered in a commonly used electronic form (paragraph 3), without adversely affecting the rights of others (paragraph 4). The article exists because people can only verify whether processing is lawful when they know what has been recorded about them (recital 63).

Key term: Right of access: the right to learn whether your data are being processed and to receive a copy, together with an explanation of the why

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Right of access includes information about automated decision-making, which relates to AI Act transparency (Art. 13) and access to documentation (Art. 86).

AI Act Art. 13 →AI Act Art. 86 →

Official text

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification and erasure

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

On request you confirm whether you process someone's data and then provide a copy with the information in paragraph 1: purposes, categories, recipients, retention period, rights, source and any automated decision-making, for example an AI system that assigns a score. The first copy is free; only for further copies may you charge a reasonable fee, and an electronic request is answered in a commonly used electronic form (paragraph 3). You verify the identity of the requester with reasonable measures (recital 64) and make sure the copy does not adversely affect the rights and freedoms of others (paragraph 4), without refusing all information for that reason (recital 63).

Data Subject

You can ask any organisation whether it processes data about you and, if so, which data, for what purpose and to whom they have been or will be disclosed (paragraph 1). You receive a copy, free of charge the first time, and in a commonly used electronic form if you asked electronically (paragraph 3). Where the organisation processes a large amount of information about you, it may ask you to specify what your request relates to (recital 63).

Compliance checklist

There is a procedure to recognise an access request, verify the identity of the requester with reasonable measures and handle the request within the period of Article 12(3) (paragraph 1, recital 64).The reply confirms whether personal data about the requester are being processed and, if so, gives access to those data (paragraph 1).The reply states the purposes, the categories of data, the recipients, the retention period or its criteria, the data subject's rights and the right to complain (paragraph 1(a) to (f)).Where the data did not come from the data subject, any available information about the source is provided (paragraph 1(g)).Where automated decision-making, including profiling referred to in Article 22, takes place, meaningful information is given about the logic involved, the significance and the envisaged consequences (paragraph 1(h)).For transfers to a third country or international organisation, the data subject is informed of the appropriate safeguards under Article 46 (paragraph 2).The data subject receives a copy of the data; a reasonable fee is charged only for further copies, and an electronic request is answered in a commonly used electronic form (paragraph 3).Before the copy is provided, it has been assessed whether it contains data about others and whether providing it would adversely affect their rights and freedoms (paragraph 4).

Related recitals

(63)

A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of,...

(64)

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller sho...

Cross-references

Art. 22: Automated individual decision-making, including profiling Art. 46: Transfers subject to appropriate safeguards

Frequently asked questions

← Art. 14: Information to be provided where personal data have not been obtained from the data subject Art. 16: Right to rectification →

Connections

Themes where this returns

The counterpart in the other law

Case law

Brillen Rottler: even a first access request can be abusive if made solely to claim compensation
2026-03-19 · final, Hof van Justitie van de EU (Vierde kamer), Brillen Rottler GmbH & Co. KG tegen TC
Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
Council of State: DPA could fine DPG Media for routinely demanding ID copies, fine halved to 262,500 euros
2025-09-24 · final, Raad van State, Afdeling bestuursrechtspraak