--- title: "Art. 15 GDPR: Right of access by the data subject" canonical: "https://dposchool.com/gdpr/article/15" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_15" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 15 GDPR · Chapter III: Rights of the data subject · Section 2: Information and access to personal data # Article 15 GDPR: Right of access by the data subject Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The data subject has the right to confirmation of whether personal data concerning him or her are being processed and, if so, to access those data and the information listed in the article. The controller must provide a copy of the personal data, and the right to obtain a copy must not adversely affect the rights and freedoms of others. ## Official text ### Article 15(1) **1.** The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: #### Article 15(1)(a) **(a)** the purposes of the processing; #### Article 15(1)(b) **(b)** the categories of personal data concerned; #### Article 15(1)(c) **(c)** the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; #### Article 15(1)(d) **(d)** where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; #### Article 15(1)(e) **(e)** the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; #### Article 15(1)(f) **(f)** the right to lodge a complaint with a supervisory authority; #### Article 15(1)(g) **(g)** where the personal data are not collected from the data subject, any available information as to their source; #### Article 15(1)(h) **(h)** the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. ### Article 15(2) **2.** Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. ### Article 15(3) **3.** The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. ### Article 15(4) **4.** The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 15 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_15) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 63](https://dposchool.com/gdpr/recital/63) - [Recital 64](https://dposchool.com/gdpr/recital/64) ## Court of Justice judgments ### [C-526/24, Brillen Rottler GmbH & Co. KG v TC](https://dposchool.com/gdpr/case/c-526-24) Judgment of 19 March 2026 · ECLI:EU:C:2026:216 Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-526/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0526) ### [C-203/22, CK v Magistrat der Stadt Wien](https://dposchool.com/gdpr/case/c-203-22) Judgment of 27 February 2025 · ECLI:EU:C:2025:117 For automated decisions, 'meaningful information about the logic involved' means explaining the procedure and principles actually applied, in an understandable way; where trade secrets or third-party data are claimed, the controller must give them to the authority or court to balance. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-203/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0203) ### [C-634/21, OQ v Land Hessen](https://dposchool.com/gdpr/case/c-634-21) Judgment of 7 December 2023 · ECLI:EU:C:2023:957 Automated credit scoring by a credit agency is itself an automated individual decision under Art. 22(1) where a third party, such as a bank, draws strongly on the score to decide whether to contract with the person. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-634/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634) ### [C-307/22, FT v DW](https://dposchool.com/gdpr/case/c-307-22) Judgment of 26 October 2023 · ECLI:EU:C:2023:811 The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-307/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307) ### [C-579/21, Proceedings brought by J.M](https://dposchool.com/gdpr/case/c-579-21) Judgment of 22 June 2023 · ECLI:EU:C:2023:501 Access requests made after 25 May 2018 cover earlier processing; people are entitled to the dates and purposes of consultations of their data, but generally not the names of employees who consulted it. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-579/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0579) ### [C-487/21, F.F. v Österreichische Datenschutzbehörde and CRIF GmbH](https://dposchool.com/gdpr/case/c-487-21) Judgment of 4 May 2023 · ECLI:EU:C:2023:369 The right to a copy means a faithful and intelligible reproduction of all the data; it can include copies of extracts or whole documents where needed for the person to exercise their rights, taking account of others' rights. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-487/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0487) ### [C-154/21, RW v Österreichische Post AG](https://dposchool.com/gdpr/case/c-154-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:3 The right of access includes the actual identity of recipients to whom data were disclosed, not just categories, unless they cannot be identified or the request is manifestly unfounded or excessive. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-154/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0154) ## EDPB guidance ### [Guidelines 01/2022 on data subject rights - Right of access](https://dposchool.com/gdpr/guidance/edpb-01-2022) EDPB 01/2022 · Final · First published 28 January 2022 · Final version 17 April 2023 Version 2.1 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en) ### [Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp251-rev-01) WP251 rev.01 · Final · Endorsed by the EDPB 25 May 2018 Date is the EDPB endorsement date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/automated-decision-making-and-profiling_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Netflix International B.V.: EUR 4,750,000](https://dposchool.com/gdpr/fine/ap-netflix-2024-11) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 26 November 2024 · Appeal status: unknown Did not tell customers clearly enough, in its privacy statement and access replies, about purposes, legal bases, recipients, retention and transfers (2018 to 2020). [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/fine-netflix) ### [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 16 May 2024 · Appeal status: not appealed Built a facial recognition database of billions of photos, including of people in the Netherlands, without a legal basis, and did not inform people or answer access requests. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/en/documents/decision-fine-clearview-ai) ### [Uber Technologies Inc. en Uber B.V.: EUR 10,000,000](https://dposchool.com/gdpr/fine/ap-uber-2023-12) Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Netherlands · Decision of 11 December 2023 · Appeal status: under appeal Unclear to drivers on retention periods and transfers outside Europe, and made it hard for them to exercise access and portability rights. [Source: the authority](https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-privacyrechten) ### [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063) ### [Spotify AB: SEK 58,000,000](https://dposchool.com/gdpr/fine/imy-spotify-2023-06) Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 12 June 2023 · Appeal status: upheld Gave users their data on request but did not explain clearly enough how it was used (purposes, categories, recipients, retention, sources, transfer safeguards). [Source: the authority](https://www.imy.se/tillsyner/spotify-ratten-till-tillgang/) ### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 17 October 2022 · Appeal status: unknown Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859) ### [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07) Hellenic Data Protection Authority, Greece · Decision of 13 July 2022 · Appeal status: unknown Facial recognition company processed people's images in Greece unlawfully, without transparency, ignored an access request and had no EU representative. [Source: the authority](https://www.dpa.gr/en/en/enimerwtiko/prakseisArxis/imposition-fine-clearview-ai-inc) ### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02) Garante per la protezione dei dati personali, Italy · Decision of 10 February 2022 · Appeal status: unknown Facial-recognition firm scraped billions of facial images, including of people in Italy, with no legal basis, without transparency, and without an EU representative; ordered to delete Italian data and stop collecting it. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9751362) ### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings. Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 15 Previous: [Art. 14 GDPR: Information to be provided where personal data have not been obtained from the data subject](https://dposchool.com/gdpr/article/14) Next: [Art. 16 GDPR: Right to rectification](https://dposchool.com/gdpr/article/16) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents