Subject access requests under the GDPR: how Article 15 works
Want to know what data your employer, local council, insurer or a web shop holds about you? You can make a subject access request. The right is set out in Article 15 GDPR. Below you can read what you may ask for, how quickly you must get an answer and how to write the request. There is also an important point for organisations: other people's data.
What can you ask for?
You have the right to know whether an organisation processes personal data about you. If it does, you are entitled to a copy of that data and to information about, among other things:
- the purposes for which the data is used;
- the categories of data;
- who the data has been or will be disclosed to, including in countries outside the EU;
- how long the data will be kept, or how that period is determined;
- your other rights, such as rectification and erasure, and the right to complain to a supervisory authority;
- the source of the data, if you did not provide it yourself;
- the existence of automated decision-making, including profiling.
In 2023 the Court of Justice of the EU ruled (case C-487/21) that the "copy" must be a faithful and intelligible reproduction of all the data. Sometimes that means copies of (extracts from) documents, where this is necessary to understand the data.
Deadline and costs
- Deadline: the organisation must respond without undue delay and at the latest within one month (Article 12(3) GDPR). For complex or numerous requests this may be extended by two further months, but you must be told within the first month, with reasons.
- Costs: the first copy is free. A reasonable fee may be charged for further copies (Article 15(3) GDPR).
- Identity: where there are reasonable doubts about who you are, the organisation may ask for additional information to confirm your identity (Article 12(6) GDPR). Don't send a full copy of your passport unless necessary, and black out your ID number and photo.
Sample subject access request
Dear Sir or Madam,
Under Article 15 of the General Data Protection Regulation (GDPR), I ask you to confirm whether you process personal data concerning me. If so, please provide me with a copy of that data and inform me of the purposes of the processing, the categories of data, the recipients, the retention period, the source of the data and the existence of any automated decision-making.
I look forward to your reply within the statutory period of one month.
Yours faithfully,
[name, address, customer number if any]
Want an AI assistant to check or rewrite the letter? First remove your name, address and customer number with VerumVault and restore them locally afterwards.
For organisations: watch out for other people's data
The right to a copy must not adversely affect the rights and freedoms of others (Article 15(4) GDPR). Do emails, notes or files also contain names or data of colleagues, customers or other people? Then you usually need to make those unreadable in the copy. Do it carefully: a black box in a PDF is not always enough. Read How to redact a document safely and Anonymise a document in 3 steps.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no accountFrequently asked questions
How long does an organisation have to answer my subject access request?
One month from receipt at the latest. For complex or numerous requests this may be extended by two months, provided you are told within the first month.
Does a subject access request cost money?
No, the first copy is free. A reasonable fee may be charged for further copies.
Do I have to send a copy of my passport?
Not as standard. Only where there are reasonable doubts about your identity may additional information be requested. Black out your ID number and photo.
What if the organisation does not respond?
You can send a reminder and then complain to your data protection authority or go to court.