Section: Data rights · Last updated: October 26, 2026
This guide is based on the text of Regulation (EU) 2016/679 (the GDPR), Articles 3, 12, 15 and 77. It is general information, not legal advice.
If a company holds personal data about you and the GDPR applies to it, you can ask that company for a copy of the data and for an explanation of what it does with it. This is the right of access in Article 15. The company must answer within one month of receiving the request, and the first copy is free of charge (Article 12).
1. When the GDPR applies to a company
Under Article 3, the regulation covers a company that processes personal data in the context of an establishment in the EU, wherever the processing happens. It also covers a company outside the EU when it processes data of people who are in the EU and the processing relates to offering them goods or services (paid or free) or to monitoring their behaviour in the EU.
So the useful question is not where the company is based, but whether it has an EU establishment or targets or monitors people in the EU.
2. What you are entitled to receive (Article 15)
| Item | What the text says | Article |
|---|---|---|
| Confirmation | Whether or not personal data about you is being processed | 15(1) |
| Purposes | Why the data is processed | 15(1)(a) |
| Categories | Which kinds of personal data are involved | 15(1)(b) |
| Recipients | Who the data has been or will be disclosed to, in particular recipients in third countries | 15(1)(c) |
| Retention | How long it will be stored, or the criteria used to decide that | 15(1)(d) |
| Your other rights | Rectification, erasure, restriction, objection, and the right to complain to a supervisory authority | 15(1)(e)–(f) |
| Source | Where the data came from, if it was not collected from you | 15(1)(g) |
| Automated decisions | Whether automated decision-making or profiling under Article 22 is used, with meaningful information about the logic and its consequences | 15(1)(h) |
| Transfer safeguards | The safeguards used when data is sent to a third country or international organisation | 15(2) |
| A copy of the data | A copy of the personal data being processed | 15(3) |
A copy of the data alone is not the full answer. The explanations in the table are part of what you can ask for.
3. Deadlines and fees (Article 12)
| Situation | Rule | Article |
|---|---|---|
| Normal answer | Without undue delay and in any event within one month of receipt | 12(3) |
| Complex or many requests | May be extended by two further months; you must be told of the extension and the reasons within the first month | 12(3) |
| Company will not act | Must tell you within one month why, and that you can complain to a supervisory authority or go to court | 12(4) |
| Request sent electronically | Answer by electronic means where possible, in a commonly used electronic form, unless you ask otherwise | 12(3), 15(3) |
| Fee | Free of charge; a reasonable fee only for further copies, or for manifestly unfounded or excessive requests | 12(5), 15(3) |
| Identity doubts | With reasonable doubts, the company may ask for additional information needed to confirm who you are | 12(6) |
The maximum is therefore three months, and only if the company tells you within the first month that it needs the extra time and why. If a request is refused as “manifestly unfounded or excessive”, the company carries the burden of showing that (Article 12(5)).
4. How to send the request
- Find the right contact. Look in the company’s privacy notice for a privacy email address, a data protection officer, or a request form. Articles 13 and 14 require the controller’s contact details in that notice.
- Say what you are asking for. Name Article 15 and ask for both the copy and the information listed in the table above.
- Help them find you. Give the email address, username or customer number linked to your account. Share only what is needed to identify you.
- Keep a dated record. Save the sent email or the form confirmation. The one-month period runs from receipt of the request.
- Follow up if the deadline passes. If there is no answer and no notice of extension, you can lodge a complaint with a supervisory authority (Article 77).
A short request can look like this:
Subject: Data subject access request under Article 15 GDPR
I am requesting access to the personal data you process about me, under Article 15 of the GDPR. Please confirm whether you process my personal data and, if so, provide a copy of it together with the information listed in Article 15(1)(a)–(h) and, if applicable, Article 15(2).
To help you locate my data: [account email / username / customer number].
As this request is made by email, please reply in a commonly used electronic format (Article 15(3)). I understand you are required to respond within one month of receipt (Article 12(3)).
5. If the company does not answer
Article 77 gives every data subject the right to lodge a complaint with a supervisory authority, in particular in the EU country where you habitually live, where you work, or where the alleged infringement took place. The authority must keep you informed of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78. The European Data Protection Board publishes a list of national data protection authorities and their contact pages.
FAQ
Q. Can a company charge me for a copy?
Not for the first copy. Article 15(3) allows a reasonable fee based on administrative costs only for further copies, and Article 12(5) allows a fee or refusal only for manifestly unfounded or excessive requests.
Q. Can they ask for my ID?
Only where they have reasonable doubts about your identity, and only for the additional information necessary to confirm it (Article 12(6)).
Q. Can parts of the copy be withheld?
Article 15(4) says the right to obtain a copy shall not adversely affect the rights and freedoms of others, so information about other people may be limited.
Q. I live outside the EU. Can I still ask?
It depends on whether the GDPR applies to that processing under Article 3 (see section 1). Other laws, such as California’s CCPA, give similar access rights in their own jurisdictions.
Official sources
- EUR-Lex — Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 3, 12, 15, 77 and 78
- European Data Protection Board (edpb.europa.eu) — list of national data protection authorities
- Your national data protection authority’s complaint page
This article is general information and not legal advice. How the rules apply depends on the company, the processing and national law; check with the relevant data protection authority for your case.