Do I really have to hand over every email and document in which the requester's name appears?

Paragraph 3 asks for a copy of the personal data undergoing processing, together with the information in paragraph 1. Paragraph 4 says that copy must not adversely affect the rights and freedoms of others, so data about other people or trade secrets can be a reason to leave parts out, but recital 63 warns that this must never result in refusing all information. The same recital says that where you process a large quantity of information, you may ask the requester to specify what the request relates to.

Can I charge for an access request?

Not for the first copy: paragraph 3 says you provide a copy and Article 12(5) says the handling of requests is free of charge. Where the data subject asks for further copies, you may charge a reasonable fee based on administrative costs (paragraph 3). Only for manifestly unfounded or excessive requests does Article 12(5) leave room to charge a fee or refuse, and you then have to demonstrate that.

Someone wants to know how our system automatically assessed their application. What do I have to provide?

Paragraph 1(h) gives the data subject the right to information about the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and at least in those cases to meaningful information about the logic involved, the significance and the envisaged consequences. Recital 63 mentions trade secrets and the intellectual property in software as interests to weigh, but also says this must not result in the data subject being refused all information.

Article 15: Right of access by the data subjectAI-relevant

Praxikon tracks Article 15 (Right of access by the data subject) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 15 gives everyone the right to ask an organisation whether it processes personal data about them and, if so, to access those data. That access comes with explanation: the purposes, the categories of data, the recipients, the retention period, the data subject's rights, the right to complain, the source where the data did not come from the person, and the existence of automated decision-making with meaningful information about the logic (paragraph 1). For transfers to a country outside the EU, the data subject is told which safeguards apply (paragraph 2). The organisation provides a copy of the data; the first copy is free and an electronic request is answered in a commonly used electronic form (paragraph 3), without adversely affecting the rights of others (paragraph 4). The article exists because people can only verify whether processing is lawful when they know what has been recorded about them (recital 63).

Key term: Right of access: the right to learn whether your data are being processed and to receive a copy, together with an explanation of the why

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Right of access includes information about automated decision-making, which relates to AI Act transparency (Art. 13) and access to documentation (Art. 86).

AI Act Art. 13 →AI Act Art. 86 →

Official text

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification and erasure

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

On request you confirm whether you process someone's data and then provide a copy with the information in paragraph 1: purposes, categories, recipients, retention period, rights, source and any automated decision-making, for example an AI system that assigns a score. The first copy is free; only for further copies may you charge a reasonable fee, and an electronic request is answered in a commonly used electronic form (paragraph 3). You verify the identity of the requester with reasonable measures (recital 64) and make sure the copy does not adversely affect the rights and freedoms of others (paragraph 4), without refusing all information for that reason (recital 63).

Data Subject

You can ask any organisation whether it processes data about you and, if so, which data, for what purpose and to whom they have been or will be disclosed (paragraph 1). You receive a copy, free of charge the first time, and in a commonly used electronic form if you asked electronically (paragraph 3). Where the organisation processes a large amount of information about you, it may ask you to specify what your request relates to (recital 63).

Compliance checklist

There is a procedure to recognise an access request, verify the identity of the requester with reasonable measures and handle the request within the period of Article 12(3) (paragraph 1, recital 64).The reply confirms whether personal data about the requester are being processed and, if so, gives access to those data (paragraph 1).The reply states the purposes, the categories of data, the recipients, the retention period or its criteria, the data subject's rights and the right to complain (paragraph 1(a) to (f)).Where the data did not come from the data subject, any available information about the source is provided (paragraph 1(g)).Where automated decision-making, including profiling referred to in Article 22, takes place, meaningful information is given about the logic involved, the significance and the envisaged consequences (paragraph 1(h)).For transfers to a third country or international organisation, the data subject is informed of the appropriate safeguards under Article 46 (paragraph 2).The data subject receives a copy of the data; a reasonable fee is charged only for further copies, and an electronic request is answered in a commonly used electronic form (paragraph 3).Before the copy is provided, it has been assessed whether it contains data about others and whether providing it would adversely affect their rights and freedoms (paragraph 4).

Related recitals

(63)

A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of,...

(64)

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller sho...

Cross-references

Art. 22: Automated individual decision-making, including profiling Art. 46: Transfers subject to appropriate safeguards

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (8)

26 October 2023 · C-307/22 · CJEU
FT v DW (medical records)
The first copy of one's own data is free, even if the patient wants it for a claim against the doctor. In a doctor-patient relationship the right to a copy can extend to the full medical record where needed.
22 June 2023 · C-579/21 · CJEU
Pankki S
Information on when and why a file was consulted falls under the right of access. The identity of the employees who consulted it in principle does not, unless essential for exercising one's rights.
4 May 2023 · C-487/21 · CJEU
F.F. v Österreichische Datenschutzbehörde (CRIF)
The right to a copy means a faithful and intelligible reproduction of all the data, including extracts or entire documents where needed to exercise one's rights.
12 January 2023 · C-154/21 · CJEU
Österreichische Post (recipients)
The right of access covers the actual identity of the recipients, not just categories, unless identification is impossible or the request is manifestly unfounded or excessive.
9 July 2020 · C-272/19 · CJEU
VQ v Land Hessen (petitions committee)
The petitions committee of a regional parliament that determines purposes and means is a controller and falls under the GDPR, including the right of access.

Show 3 more

20 December 2017 · C-434/16 · CJEUDirective 95/46
Nowak
A candidate's written exam answers and the examiner's comments on them are personal data of the candidate.
17 July 2014 · C-141/12, C-372/12 · CJEUDirective 95/46
YS and Others
The data about an applicant in an internal memo are personal data, but the legal analysis itself is not. For access, a full and intelligible summary of the data is enough; a copy of the document is not required.
7 May 2009 · C-553/07 · CJEUDirective 95/46
Rijkeboer
The right of access also covers information on past recipients. Member States set a retention period that strikes a fair balance between the data subject's interests and the burden on the controller.

Guidelines (1)

28 March 2023 · v2.1 · EDPB
Guidelines 01/2022 on data subject rights - Right of access
Describes the scope of the right of access, which information and copies an organisation must provide, in what form and within which time limit.

Fines (3)

26 November 2024 · Dutch Data Protection Authority€4,750,000
Netflix: unclear information to customers
Between 2018 and 2020 Netflix's privacy statement and its replies to access requests did not clearly explain the purposes and legal bases of its processing, who data were shared with, how long data were kept, and how transfers outside Europe were safeguarded.
Decision of 26 November 2024, announced on 18 December 2024. Netflix objected to the fine.
16 May 2024 · Dutch Data Protection Authority€30,500,000
Clearview AI: illegal database of face prints
Clearview scraped billions of photos from the internet and turned faces into biometric codes, without a legal basis and in breach of the ban on processing biometric data. It did not inform people, ignored access requests and had no representative in the EU.
Decision of 16 May 2024, announced on 3 September 2024. Clearview did not object, so the fine is final. The AP imposed no separate fine for the missing EU representative (Article 27).
15 July 2021 · CNPD (Luxembourg)€746,000,000
Amazon: targeted advertising without a valid legal basis
Amazon processed personal data for interest-based advertising on the basis of legitimate interest, which was not a valid legal basis. It also fell short on informing users and on honouring rights such as access, rectification and erasure.
The administrative tribunal upheld the fine on 18 March 2025. On appeal, the Administrative Court annulled the decision on 12 March 2026 and sent the case back to the CNPD, because the CNPD had not assessed whether Amazon acted intentionally or negligently and had not weighed which corrective measure was most appropriate. The core findings of infringement were confirmed; the Article 21 complaints were held to fall outside the scope of the inquiry.

Line of case lawThe right of access

What must you provide on an access request, and when may you refuse?

Rijkeboer (2009)Access also covers past recipients.
YS and Others (2014)A full summary is enough; no right to copies of documents.
Nowak (2017)Exam scripts are personal data and so in principle accessible.
Österreichische Post (recipients) (2023)You are entitled to the actual recipients, not just categories.
F.F. v Österreichische Datenschutzbehörde (CRIF) (2023)A copy is a faithful reproduction, including whole documents where needed.
Pankki S (2023)Log data fall under access, employee names in principle do not.
FT v DW (medical records) (2023)The first copy is free, even for a claim.
Guidelines 01/2022 on data subject rights - Right of access (2023)The EDPB brings the access rules together in guidelines.
Dun & Bradstreet Austria (2025)For automated decisions, an intelligible explanation of the logic follows.
Brillen Rottler (2026)An abusive first request may be refused as excessive.

Line of case lawAutomated decision-making

When is a score a decision, and what explanation do you get?

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (2018)The guidelines read Article 22 as a prohibition with exceptions.
SCHUFA (scoring) (2023)A credit score a bank relies on heavily is itself a decision.
Dun & Bradstreet Austria (2025)Right to an intelligible explanation of procedure and principles.
Digital Omnibus: proposal amending the GDPR (2025)Proposal to rewrite Article 22.

Checked on 5 November 2026

Frequently asked questions

← Art. 14: Information to be provided where personal data have not been obtained from the data subject Art. 16: Right to rectification →

Connections

Themes where this returns

Where this meets the other law

The right to explanation in Article 86 only supplements the GDPR
applies only in addition to

The counterpart in the other law

Case law

Brillen Rottler: even a first access request can be abusive if made solely to claim compensation
2026-03-19 · final, Hof van Justitie van de EU (Vierde kamer), Brillen Rottler GmbH & Co. KG tegen TC
Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt
Council of State: DPA could fine DPG Media for routinely demanding ID copies, fine halved to 262,500 euros
2025-09-24 · final, Raad van State, Afdeling bestuursrechtspraak