Art. 15 GDPR · Chapter III: Rights of the data subject · Section 2: Information and access to personal data
Article 15 GDPR: Right of access by the data subject
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The data subject has the right to confirmation of whether personal data concerning him or her are being processed and, if so, to access those data and the information listed in the article. The controller must provide a copy of the personal data, and the right to obtain a copy must not adversely affect the rights and freedoms of others.
Official text
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from the data subject, any available information as to their source;
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-526/24, Brillen Rottler GmbH & Co. KG v TC
Judgment of 19 March 2026ECLI:EU:C:2026:216
Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown.
- C-203/22, CK v Magistrat der Stadt Wien
Judgment of 27 February 2025ECLI:EU:C:2025:117
For automated decisions, 'meaningful information about the logic involved' means explaining the procedure and principles actually applied, in an understandable way; where trade secrets or third-party data are claimed, the controller must give them to the authority or court to balance.
- C-634/21, OQ v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:957
Automated credit scoring by a credit agency is itself an automated individual decision under Art. 22(1) where a third party, such as a bank, draws strongly on the score to decide whether to contract with the person.
- C-307/22, FT v DW
Judgment of 26 October 2023ECLI:EU:C:2023:811
The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy.
- C-579/21, Proceedings brought by J.M
Judgment of 22 June 2023ECLI:EU:C:2023:501
Access requests made after 25 May 2018 cover earlier processing; people are entitled to the dates and purposes of consultations of their data, but generally not the names of employees who consulted it.
- C-487/21, F.F. v Österreichische Datenschutzbehörde and CRIF GmbH
Judgment of 4 May 2023ECLI:EU:C:2023:369
The right to a copy means a faithful and intelligible reproduction of all the data; it can include copies of extracts or whole documents where needed for the person to exercise their rights, taking account of others' rights.
- C-154/21, RW v Österreichische Post AG
Judgment of 12 January 2023ECLI:EU:C:2023:3
The right of access includes the actual identity of recipients to whom data were disclosed, not just categories, unless they cannot be identified or the request is manifestly unfounded or excessive.
EDPB guidance
- Guidelines 01/2022 on data subject rights - Right of access
EDPB 01/2022FinalFirst published 28 January 2022Final version 17 April 2023
Version 2.1 is final.
- Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679
WP251 rev.01FinalEndorsed by the EDPB 25 May 2018
Date is the EDPB endorsement date.
Fines
Amounts are shown in the currency in which the fine was imposed.
- Netflix International B.V.: EUR 4,750,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 26 November 2024Appeal status: unknown
Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020).
- Clearview AI Inc.: EUR 30,500,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 16 May 2024Appeal status: not appealed
Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests.
- Uber Technologies Inc. en Uber B.V.: EUR 10,000,000
Autoriteit Persoonsgegevens (Dutch Data Protection Authority), NetherlandsDecision of 11 December 2023Appeal status: under appeal
Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights.
- CRITEO: EUR 40,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 15 June 2023Appeal status: unknown
Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners.
- Spotify AB: SEK 58,000,000
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), SwedenDecision of 12 June 2023Appeal status: upheld
Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards).
- Clearview AI: EUR 20,000,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 17 October 2022Appeal status: unknown
Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.
- Clearview AI, Inc: EUR 20,000,000
Hellenic Data Protection Authority, GreeceDecision of 13 July 2022Appeal status: unknown
Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative.
- Clearview AI: EUR 20,000,000
Garante per la protezione dei dati personali, ItalyDecision of 10 February 2022Appeal status: unknown
Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it.
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.