Right of access

What it means

The right of access is one of the core rights of data subjects under the GDPR. Anyone can ask a company to confirm whether it processes their personal data and, if so, obtain a copy together with information on the purpose, categories of data, recipients, retention period and source.

A request can come from a customer, former employee, job applicant or anyone whose data the company holds. They do not have to give a reason or use any form; an email or letter is enough. The company must respond without undue delay, as a rule within one month of receiving the request.

The right of access is the gateway to the other rights. Only by knowing what data a company holds can a person ask for correction, restriction, portability or exercise the right to erasure. That is why supervisory authorities treat breaches of it strictly.

How it works in practice

It helps companies to decide in advance who receives and handles requests. If the company has a data protection officer, they usually run the process. What matters is that a request arriving, say, with a salesperson or at reception does not get lost and reaches the right person the same day.

When handling a request, we start from the record of processing activities, which shows the systems where data may sit: accounting, payroll, CRM, email, CCTV footage. Without it, something is easily overlooked and the answer is incomplete.

Before sending data, verify the requester’s identity so it does not reach the wrong person. Third parties’ data, such as colleagues in email threads, must also be protected and redacted in the copy. The first copy is free of charge.

What to watch out for

The most common mistake is missing the deadline. A month passes quickly, and it can be extended only for complex or numerous requests, with the requester told about the extension and why within the original period. Doing nothing is a breach in itself.

Former employees sometimes use the right of access to gather evidence for an employment dispute. The company must still respond. It cannot refuse merely because it suspects such a motive, though it may reject manifestly unfounded or excessive requests, which it must be able to justify.