Data subject rights: when a customer asks for their data, you have a month
Everyone has the right to know what data is processed about them and to get a copy. What the reply must contain, by when, what may be refused and what customer service must know.
· 6 min read
In brief
The General Data Protection Regulation gives everyone the right to obtain from the controller confirmation of whether their personal data is being processed and, if it is, access to the data, information about the processing and a copy of the data. The request must be answered without undue delay and in any event within one month of receipt. Alongside the right of access stand the rights to rectification, erasure, restriction, data portability and objection. A request rarely arrives at the data protection officer; it arrives at customer service, the registry or a supervisor, and recognising it is therefore every employee's skill.
What the regulation gives a person the right to know
Article 15 of the GDPR is the right of access. Paragraph 1 gives the data subject the right to obtain confirmation of whether personal data concerning them is being processed and, where it is, access to the data and the following information: the purposes of the processing, the categories of data, the recipients or categories of recipients, in particular in third countries, the envisaged retention period or the criteria used to determine it, the right to request rectification, erasure or restriction or to object, the right to lodge a complaint with a supervisory authority, the source of the data where it was not collected from the person, and the existence of automated decision-making including profiling with meaningful information about its logic and consequences.
Under paragraph 3 the controller shall provide a copy of the personal data undergoing processing. Where the request was made electronically, the information is provided in a commonly used electronic form unless the person asks otherwise. A reasonable fee based on administrative costs may be charged for further copies. Providing the copy must not adversely affect the rights and freedoms of others: other people's data is redacted to the extent that disclosing it would infringe their rights, and the balance is struck case by case, not by rule.
One month, and from when
Article 12 of the regulation lays down the procedure for all the rights in Articles 15 to 22. Under paragraph 3, information on the action taken must be provided without undue delay and in any event within one month of receipt of the request. The period may be extended by two further months where necessary, taking into account the complexity and number of requests, but the requester must be informed of the extension and the reasons for the delay within one month of receipt.
If the controller does not take action, paragraph 4 requires it to inform the person without delay and at the latest within one month of the reasons, and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. Silence is therefore not an option: a refusal is also an answer, given within the month and reasoned.
The deadline runs from receipt of the request. A request is received when it reaches the organisation, not when it finds its way to the data protection officer's desk. A request made over the phone that the agent does not record has still been received, and the month is running. This is why recognition is taught to everyone.
| Right | Article | What it means in practice |
|---|---|---|
| Access | 15 | Confirmation, information on processing, a copy |
| Rectification | 16 | Inaccurate data is corrected, incomplete data completed |
| Erasure | 17 | Data is deleted when the basis has lapsed or processing is unlawful; there are exceptions, such as a legal obligation |
| Restriction | 18 | Processing is frozen, for example while a rectification claim is examined |
| Portability | 20 | Data the person provided, in a machine-readable form, where processing rests on consent or contract and is carried out by automated means |
| Objection and automated decisions | 21–22 | The right to object to certain processing and not to be subject to a solely automated decision with significant effects |
Who is asking
Article 12(6) allows the controller to request additional information necessary to confirm the identity of the data subject where it has reasonable doubts about the identity of the person making the request. This is the other side of an access request: a copy of someone's data sent to the wrong person is itself a data breach. In customer service, identification and access requests are therefore the same course, and our skills catalogue treats identifying a caller as part of recognising phishing and manipulation: a fraudster makes an access request in someone else's name precisely because the person answering wants to be helpful.
The identification requirement must not become an obstacle, however. Paragraph 2 obliges the controller to facilitate the exercise of rights, and additional information may be requested only where needed. A person already identified as a customer does not need to be identified again for an access request.
What may be refused
Under Article 12(5), information and actions are provided free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable administrative fee or refuse to act. The burden of demonstrating that a request is unfounded or excessive lies with the controller. The threshold is deliberately high: a laborious request is not excessive, and an unpleasant requester is not unfounded.
Partial refusal is more common than total. Other people's data and trade secrets are redacted from the copy to the extent needed to protect their rights, after a case-by-case balancing, and national law may restrict the right, for instance to protect an investigation or another person. Every limitation is reasoned in the reply. Level 3 of our skills catalogue says this directly: handles the request, assesses the limitations and gives reasons for a partial refusal.
What this requires of each role
The right of access is ultimately a division of labour. Every employee must know that a person has the right to see their data, and must recognise a request when one arrives. Customer service must receive the request correctly, record it and know the deadline, and must not answer by guessing. The person handling the request must decide what is disclosed and give reasons for any limits. The data protection officer must resolve conflicts between competing rights and assess whether automated decision-making is permissible, to which the AI Act adds its own layer.
These are the four levels of the same skill in our catalogue, which is why the same topic appears in the library as two courses: one for all staff, one for customer service. The data protection officer's part is covered in When must a data protection officer be appointed and what must they know?, and the staff's data protection competence as a whole in What data protection competence is required of every employee?.
What the right of access is not
It is not a right to documents. The requester is entitled to their own personal data and information about its processing, not to every document in which their name appears. Documents held by public authorities are additionally governed by the Act on the Openness of Government Activities, which is a different right with a different procedure. Nor is it a right to have everything deleted: the right to erasure has exceptions, and a statutory retention obligation takes precedence. A good reply says what was provided, what was not, and why.
Frequently asked questions
How quickly must an access request be answered?
Without undue delay and in any event within one month of receiving the request. The period may be extended by two further months where requests are complex or numerous, but the requester must be told of the extension and its reasons within one month. If the request is refused, that too must be communicated within a month, with reasons and a pointer to the right to complain to the Data Protection Ombudsman.
What does the right of access cover?
Confirmation of whether the person's data is being processed and, if so, access to the data and information on the purposes, the categories of data, the recipients, the retention period or its criteria, the person's rights, the right to complain, the source of the data and any automated decision-making. In addition a copy of the data being processed, in a commonly used electronic form when the request was made electronically.
May a fee be charged for an access request?
As a rule, no. Information and actions are free of charge. Where requests are manifestly unfounded or excessive, in particular repetitive, the controller may charge a reasonable administrative fee or refuse to act, but it must itself demonstrate that the request is unfounded or excessive. A reasonable fee based on administrative costs may be charged for further copies.
What must a customer service agent do when the request comes by phone?
Recognise that it is a request under the GDPR even if the caller does not use that word, record it and route it along the organisation's agreed path, and not answer by guessing or reading data out over the phone. Where there are reasonable doubts about identity, the controller may ask for additional information to confirm it. The deadline runs from receipt of the request, not from when it reaches the right desk.