Overview

This article grants data subjects the right to access their personal data held by an organization. Individuals can confirm whether their data is being processed and obtain details about the purposes, categories of data, recipients, and their rights. Access must be provided promptly and free of charge.

Key Principles

  • Transparency: Data subjects should understand what personal data is held and how it is processed.

  • Access to Information: Include details on purposes, categories, recipients, and retention periods.

  • Timeliness and Free Access: Responses must be provided promptly and without cost to the data subject.

  • Accountability: Organizations must maintain records demonstrating compliance with access requests.

Organizational Applicability

This article applies to all organizations processing personal data within the EU:

  • Controllers handling data of EU/EEA residents.

  • Public and private sector entities responsible for providing access to personal data.

  • Teams managing customer service, privacy requests, legal, or compliance operations.

Implementation Requirements

  • Establish procedures to handle data subject access requests (DSARs).

  • Provide all required information in clear and accessible formats.

  • Maintain records of requests and responses for accountability.

  • Ensure verification of the requestor’s identity before granting access.

Implementation Guidance

  • Use standardized access request forms or portals for submitting and tracking requests.

  • Train staff to respond accurately, fully, and within the statutory timeframe.

  • Monitor processing times to ensure prompt responses.

  • Implement mechanisms to verify the identity of the data subject safely.

Periodic Review

  • Frequency: Annually or when access request processes change.

  • Responsible Role: Data Protection Officer (DPO) or Compliance Team.

  • Outcome: Confirm all access requests are handled efficiently, transparently, and in compliance with GDPR.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Complaints, investigations, or enforcement actions for failing to provide access.

  • Reputational Damage: Loss of trust from data subjects and stakeholders.

  • Operational Risk: Inefficient or incomplete access handling can lead to regulatory scrutiny.