---
title: GDPR Article 15 – Right of Access by the Data Subject
slug: gdpr-art-15-right-to-access
topic: data-protection
lang: en
valid_from: 2018-05-25
valid_to: null
last_reviewed: 2026-05-28
status: current
authority_level: A
license: CC-BY-4.0
url: https://nexvyra.de/en/fakten/gdpr-art-15-right-to-access.md
wikidata_subjects: [Q1172506, Q60520997]
de_version: https://nexvyra.de/fakten/dsgvo-auskunftsrecht-art-15.html
---

# GDPR Article 15 – Right of Access by the Data Subject

## Short answer

Under Article 15 of the General Data Protection Regulation (GDPR), every individual has the right to obtain confirmation from the controller as to whether personal data concerning them is being processed. If so, they are entitled to access that data as well as to **a free first copy** of the processed data. The controller must provide the information pursuant to Art. 12(3) GDPR **within one month** of receipt of the request; this period may be extended by **up to two further months** if the request is complex or numerous. No justification by the requesting person is required.

## Key facts

| Item | Value |
|---|---|
| Legal basis | Regulation (EU) 2016/679, Article 15 |
| Right holder | any natural person whose data is being processed ("data subject") |
| Right addressee | controller as defined in Art. 4(7) GDPR |
| Response deadline (Art. 12(3)) | 1 month from receipt of the request |
| Extension | up to 2 additional months for complex or numerous requests |
| Notification of extension | within the first month, including reasons |
| First copy of data (Art. 15(3)) | free of charge |
| Further copies | reasonable fee based on administrative costs permitted |
| Form for electronic requests | where possible, common electronic format |
| Form of information | concise, transparent, intelligible, easily accessible (Art. 12(1)) |
| Justification by requester | not required |
| Limit (Art. 15(4)) | rights and freedoms of others (e.g., trade secrets, copyright) |

## Content of the access information (Art. 15(1) lit. a–h)

If processing is confirmed, the controller must additionally provide:

- **(a)** purposes of processing,
- **(b)** categories of personal data concerned,
- **(c)** recipients or categories of recipients to whom the data have been or will be disclosed (especially recipients in third countries or international organisations),
- **(d)** where possible, the envisaged storage period or, if not possible, the criteria used to determine that period,
- **(e)** the existence of the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), or to object (Art. 21),
- **(f)** the right to lodge a complaint with a supervisory authority,
- **(g)** where the data was not collected from the data subject, any available information about its source,
- **(h)** the existence of automated decision-making, including profiling (Art. 22(1) and (4)), meaningful information about the logic involved, as well as the significance and envisaged consequences.

Where personal data are transferred to a third country or to an international organisation, the data subject also has the right under Art. 15(2) GDPR to be informed of the appropriate safeguards pursuant to Art. 46 GDPR.

## Right to a copy (Art. 15(3))

Art. 15(3) GDPR obliges the controller to provide the data subject with a copy of the personal data undergoing processing. According to the German DSK (Data Protection Conference) Short Paper No. 6, "copy" usually does not mean a photo or full-document copy, but a structured representation of the data processed about the person — the decisive factor is that no personal data is missing. If the data subject makes the request electronically, the information is to be provided in a common electronic format where possible, unless otherwise requested.

The **first copy is free of charge**. For further copies, the controller may charge a reasonable fee based on administrative costs.

## Deadline and extension (Art. 12(3))

Information must be provided "without undue delay and in any event within one month of receipt of the request". This period may be extended **by two further months** where necessary, taking into account the complexity and number of requests. The controller must inform the data subject of any such extension **within one month** of receipt of the request, together with the reasons. Where the controller does not take action, they must equally inform the data subject within one month of the reasons and of the possibility to lodge a complaint with a supervisory authority and to seek judicial remedy.

## Limits of the right of access (Art. 15(4))

The right to obtain a copy under Art. 15(3) must not adversely affect the rights and freedoms of others. When granting access, the controller may withhold or redact content if, otherwise, trade secrets, intellectual property rights, or third-party personal data would be disclosed. Furthermore, § 34 BDSG (German Federal Data Protection Act) provides narrowly defined national exceptions to the right of access (e.g., where retention is required solely for data backup or data protection oversight purposes).

## Form, identity verification, and costs

The request is generally form-free: written, by e-mail, or oral. The controller may request additional information to verify identity if there are reasonable doubts (Art. 12(6)). The access itself — like the first data copy — is **generally free of charge**. Only in the case of manifestly unfounded or excessive (particularly repetitive) requests may the controller charge a reasonable fee or refuse to act; the burden of demonstrating this lies with the controller (Art. 12(5)).

## Sources

- Regulation (EU) 2016/679 – General Data Protection Regulation, full text (EUR-Lex):
  https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
- BfDI (German Federal Commissioner for Data Protection) – Right of Access (Art. 15 GDPR), in German:
  https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Betroffenenrechte/Betroffenenrechte_Auskunftsrecht.html
- German DSK – Short Paper No. 6 "Right of Access by the Data Subject, Art. 15 GDPR", in German:
  https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_6.pdf
- European Data Protection Board (EDPB):
  https://www.edpb.europa.eu/

## German version

- [DSGVO Art. 15 – Auskunftsrecht der betroffenen Person](https://nexvyra.de/fakten/dsgvo-auskunftsrecht-art-15.html)

## Status

- Last reviewed: 2026-05-28
- Valid from: 2018-05-25 (entry into force of GDPR)
- Status: current
- Source authority: A (EUR-Lex, BfDI, DSK, German state DPAs)
- License: CC BY 4.0