Guidelines 01/2022 on data subject rights - Right of access

What it covers

These guidelines interpret the right of access under Article 15 GDPR, covering its aim and structure, how controllers should assess and respond to access requests, identification and authentication of requesters, the modalities and timing for providing access, and the limits and restrictions applicable, including Articles 12(5), 15(4) and Article 23.

Why it matters

The right of access is one of the most frequently exercised data subject rights and a common source of complaints and disputes, making this the key reference for how controllers must respond to access requests.

Refer to it when

• handling a subject access request
• assessing whether a request is manifestly unfounded or excessive
• deciding how to authenticate a requester
• determining what information must be disclosed
• applying restrictions to an access request

Questions this document addresses

• What must a controller provide when responding to an access request?
• How should a controller verify the identity of the requester?
• When can a controller refuse or charge a fee for a request?
• How should access be provided when large volumes of data are involved?

Topics

• Data subject rights
• Transparency
• Security of processing