How long does a controller have to respond to a GDPR Art. 15 request?

One month from receipt of the request, per Art. 12(3) GDPR. Extendable by up to two further months if the request is complex or numerous, with notification of the extension within the first month.

Does the data subject need to justify a Right of Access request?

No. Art. 15 GDPR does not require any justification. The controller may, however, ask for additional information to verify the requester's identity if there are reasonable doubts (Art. 12(6)).

Is the first copy of personal data free under Art. 15(3)?

Yes. The first copy is free of charge. For further copies, the controller may charge a reasonable fee based on administrative costs.

Can the controller refuse a Right of Access request?

Only in narrow cases: where the request would adversely affect rights and freedoms of others (Art. 15(4)), or where it is manifestly unfounded or excessive (Art. 12(5)). The burden of proof lies with the controller.

GDPR Article 15 – Right of Access by the Data Subject

Machine-readable version: /en/fakten/gdpr-art-15-right-to-access.md · German version: DE

GDPR Data Protection EU Law Germany Article 15

Short answer Under Article 15 GDPR, any person can request confirmation from a controller as to whether personal data concerning them is being processed. If yes, they are entitled to access, plus a free first copy of the data. The controller must respond within one month (Art. 12(3)), extendable by up to two further months for complex or numerous requests. No justification by the data subject is required.

Key facts

Item	Value
Legal basis	Regulation (EU) 2016/679, Article 15
Right holder	any natural person whose data is being processed
Right addressee	controller as defined in Art. 4(7) GDPR
Response deadline	1 month (Art. 12(3))
Extension	up to 2 additional months
First copy	free (Art. 15(3))
Further copies	reasonable fee based on administrative costs
Justification	not required
Limit	rights of others (Art. 15(4)); manifestly unfounded/excessive (Art. 12(5))

Content of access information (Art. 15(1) lit. a–h)

If processing is confirmed, the controller must also provide:

(a) purposes of processing
(b) categories of personal data
(c) recipients or categories (especially in third countries or international organisations)
(d) envisaged storage period, or criteria for determining it
(e) existence of rights to rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), or objection (Art. 21)
(f) right to lodge a complaint with a supervisory authority
(g) where data was not collected from the data subject: information about its source
(h) existence of automated decision-making, including profiling (Art. 22), with meaningful information about the logic, significance, and envisaged consequences

If personal data are transferred to a third country or international organisation, the data subject also has the right under Art. 15(2) GDPR to be informed of the appropriate safeguards under Art. 46.

Right to a copy (Art. 15(3))

Art. 15(3) requires the controller to provide a copy of the personal data undergoing processing. According to the German Data Protection Conference (DSK) Short Paper No. 6, "copy" usually means a structured representation of the processed personal data — not necessarily a photocopy or full-document copy. The decisive factor is that no personal data is missing.

The first copy is free of charge. For further copies, a reasonable fee based on administrative costs is permitted.

Deadline and extension (Art. 12(3))

Information must be provided "without undue delay and in any event within one month of receipt of the request". The deadline may be extended by up to two further months for complex or numerous requests. The controller must notify the data subject of any extension within the first month, including the reasons. If the controller does not act, they must equally inform the data subject within one month about the reasons and the right to lodge a complaint with a supervisory authority and to seek judicial remedy.

Limits of the right of access (Art. 15(4))

The right to a copy must not adversely affect the rights and freedoms of others. The controller may withhold or redact content if, otherwise, trade secrets, intellectual property rights, or third-party personal data would be disclosed. § 34 BDSG (German Federal Data Protection Act) provides narrowly defined national exceptions, e.g., where data retention is required solely for backup or data protection oversight.

Form, identity verification, and costs

The request is form-free: written, by e-mail, or oral. The controller may request additional identifying information if there are reasonable doubts (Art. 12(6)). Both the access and the first copy are generally free of charge. Only manifestly unfounded or excessive (particularly repetitive) requests may be charged or refused — and the controller bears the burden of demonstrating this (Art. 12(5)).

Sources

Regulation (EU) 2016/679 – GDPR full text (EUR-Lex, English): eur-lex.europa.eu
BfDI – Right of Access (Art. 15 GDPR), in German: bfdi.bund.de
German DSK – Short Paper No. 6, in German: datenschutzkonferenz-online.de
European Data Protection Board (EDPB): edpb.europa.eu

Last reviewed:: 2026-05-28
Valid from:: 2018-05-25 (entry into force of GDPR)
Status:: current
Source authority:: A (EUR-Lex, BfDI, DSK, German state DPAs)
License:: CC BY 4.0

This page is a translation of the German original. The German version is binding and is updated by the daily fact-check agent. The English version is provided for international audiences. In case of doubt, refer to the German version.