Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Full Definition
The Right to Access (Article 15 GDPR; equivalent rights exist under CCPA, DPDP Act, and most privacy laws) allows individuals to request confirmation that their personal data is being processed and, if so, to receive a copy of the data plus information including: purposes of processing, categories of data, recipients or categories of recipients, intended retention periods, information about other rights, and any available information about data sources. Under GDPR, responses must be provided within 30 days. The right is foundational to data subject autonomy — it enables individuals to verify whether their data is accurate and whether processing is lawful.
How each law treats it
The right of access entitles the data subject to confirmation that their data is being processed, access to the data, and specific information about the processing (purposes, recipients, retention, source, automated decision-making).
Data Principals may request a summary of personal data, the identities of other Fiduciaries and Processors with whom the data has been shared, and any other information prescribed by the DPDP Rules.
Consumers have the right to know what categories of personal information are collected, used, sold or disclosed, and the right to receive a copy of the specific pieces of personal information.
In practice
- The response must be concise, transparent, intelligible and in easily accessible form (GDPR Article 12(1)). A dump of raw database tables is not sufficient.
- Scope the response correctly — personal data of the requester only, not third-party data mentioned in the same documents.
- Deliver electronically where the request was made electronically; delivery format is the subject's choice where available.
Common pitfalls
- Over-redacting. Redaction of third-party personal data is permitted; redaction of the requester's own data is not.
- Delivering only the data without the Article 15(1) information (purposes, retention, recipients). The information duty is as important as the data copy.
- Treating the request as closed after the first response. If the processing continues, the subject can re-request.
Frequently asked questions
Can I charge for an access request?+
GDPR permits a reasonable fee only for manifestly unfounded or excessive repeat requests. CCPA permits a fee for substantially the same request within 12 months. The default stance is no fee.
How much detail must I give about recipients?+
The named recipients, not just categories. The CJEU in RW v Österreichische Post (2023) confirmed that the controller must disclose the identities of recipients on request.
What about data held by processors on my behalf?+
It's your data for access-right purposes. The processor must assist you under Article 28(3)(e); the access response covers all data held under your controller relationship.
Related terms
DSAR
Data Subject Access Request — a formal request from an individual to access the personal data an organisation holds about them.
Right to Erasure
An individual's right to have their personal data deleted ('right to be forgotten') in certain circumstances.
Right to Data Portability
A data subject's right to receive their personal data in a structured, machine-readable format and to transfer it to another controller.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes