GDPR right of access: find out what data a company holds about you

The right of access (GDPR Article 15) lets you obtain confirmation that an organisation processes your personal data and receive a copy, together with information about the purposes, data categories and recipients. Send your request to its data protection officer (DPO) or privacy contact. It must reply without undue delay, normally within one month. Access complements the right to erasure in Article 17: first see the data, then ask to delete it if you wish and the conditions apply.

At a glance

• Article 15 lets you find out whether a company holds your data and what it holds, including a copy.
• Article 17 lets you request erasure. Read Article 17 in practice.
• The usual deadline is one month. Access is normally free, with exceptions for manifestly unfounded or excessive requests.
• It can be useful before asking a data broker to erase your information.

When to use the right of access

• You do not know what a company holds in a marketing file, scoring record or directory entry.
• You want to check accuracy before requesting a correction.
• A broker says it holds nothing about you, yet your profile is visible online. An access request asks for a formal answer.
• You are preparing a CNIL complaint or a follow-up. See brokers that do not reply.

For an overview, read your personal data rights. Access is often the first step before erasure.

What to include in an access request

Adapt this template for an email, or a registered letter with proof of delivery if necessary:

Subject: Exercise of my right of access under GDPR Article 15

Dear Sir or Madam,

I, [full name], of [address], email [email address], wish to exercise my right of access under Article 15 of Regulation (EU) 2016/679 (GDPR).

Please confirm whether you process personal data concerning me and, if so, provide:

• a copy of my personal data;
• the purposes of the processing;
• the categories of personal data;
• the recipients or categories of recipients;
• the intended retention period;
• the source of the data if it was not collected from me.

Please let me know if proportionate additional information is necessary to verify my identity. I would appreciate a response within one month.

Yours faithfully, [Signature]

Tip: do not automatically send a full identity document. If there are reasonable doubts about your identity, the organisation may ask for additional information necessary to verify it. Only provide what is necessary, and mask unrelated information where appropriate.

Response time and format

The organisation must reply without undue delay and no later than one month after receiving your request. It may extend this by two additional months where necessary because of the complexity or number of requests, but must inform you within the first month. The reply must be clear. When you make an electronic request, the information should normally be provided electronically too.

If it refuses or does not reply, send a dated follow-up, then contact the CNIL, the French data protection authority, where appropriate. Adapt these general steps to your circumstances.

Access or erasure: which should you choose?

To address data held by multiple brokers, start with a scan to identify where you appear. The removal process then lets you send erasure requests on your behalf for the targets you select.

Data brokers and the Data Knight scan

Data brokers subject to the GDPR must respond like other data controllers. A request to one broker does not tell you where else your information appears. The Data Knight scan maps the public web, data brokers and known breaches so you can prioritise access requests, erasure requests or both.

Read who buys and sells personal data to understand why these organisations hold such files.

See also: Article 17 and erasure · The right to object, Article 21 · Brokers that do not reply · Privacy rights explained