Enforcement · DSB ·2025-0.395.497 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

DSB: Art. 15 GDPR access right does not extend to full documents with third-party data

Original title: DSB (Austria) - 2025-0.395.497

Austria
Right of Access Personal Data Supervisory Authorities Controllers Data Subject Rights Exercise Modalities and Procedures
Jan 12, 2026
Summary

The data protection authority (DPA) has determined that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right does not extend to complete documents that contain information about third parties. Confidential communications and legal advice within disciplinary proceedings are excluded. The data protection authority (DPA) has determined that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right does not extend to complete documents that contain...

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The data protection authority (DPA) ruled that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right does not extend to complete documents that contain information about third parties. Confidential communications and legal advice within disciplinary proceedings are excluded. The data protection authority (DPA) ruled that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right does not extend to complete documents that contain information about third parties. Confidential communications and legal advice within disciplinary proceedings are excluded. Summary in English. Summary in English. Facts. The individual filed a disciplinary complaint against a lawyer with a regional bar association (the responsible party). He then submitted a request for access under Article 15 of the GDPR, requesting all personal data about himself.

Personal Data Supervisory Authorities applies Art. 15
§

The bar association provided some information but refused to provide further information. --- *This content has been automatically translated using machine translation. The original version is available in the source language.* --- *This content was automatically translated using machine translation. The original version is available in the source language.*

How it connects

1 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

Related across sources

C-487/21 Österreichische Datenschutzbehörde v CRIF C-487/21 (Österreichische Datenschutzbehörde) CJEU Oct 26, 2023 Right of Access Right to Restriction Personal Data
C-434/16 Peter Nowak v Data Protection Commissioner C-434/16 (Nowak) CJEU Dec 20, 2017 Right of Access Personal Data Right to be Forgotten
CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) Jun 29, 2010 Personal Data Legitimate Interest Right to Restriction
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines ·EDPB Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
Guidelines 01/2022 data subject rights - Right of access Guidelines ·EDPB Apr 17, 2023 Right of Access Personal Data Right to Rectification
C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
Related documents