Right of Access

A fundamental data subject right enabling individuals to obtain confirmation about whether their personal data is being processed and receive a copy of that data along with supplementary information. Under GDPR Article 15, individuals can request: confirmation of processing, purposes of processing, data categories, recipients, retention periods, rights information, data source, existence of automated decision-making, and safeguards for international transfers. The first copy should be provided free of charge, with reasonable fees for additional copies. Organizations must verify the requestor's identity and respond within one month (extendable by two months for complex requests). Responses should be in commonly used electronic format if requested electronically. This right empowers individuals to understand how their data is used and verify lawfulness. However, it doesn't override others' rights—organizations may redact third-party information or refuse requests that are manifestly unfounded or excessive. Access requests often reveal compliance gaps, making proper response processes crucial.