Laws · GDPR ·art-12-par-3 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Full text
The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
How it connects
Cited by
- Belgian DPA: Legitimate interest can justify direct marketing to recent former customers
- Guidelines 01/2022 on data subject rights - Right of access
- Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them
- Guidelines 3/2019 on processing of personal data through video devices
- Guidelines 04/2022 on the calculation of administrative fines under the GDPR
All 148
- Employer: Insufficient fulfilment of data subjects rights
- Local bank: Insufficient fulfilment of data subjects rights
- American College of Greece: Insufficient fulfilment of information obligations
- BELGIUM DPA: Insufficient fulfilment of data subjects rights
- BELGIUM DPA: Insufficient legal basis for data processing
- Poliambulatorio Talenti S.r.l.: Insufficient fulfilment of data subjects rights
- Ordine degli Assistenti Sociali della Regione Lazio: Insufficient fulfilment of data subjects rights
- Planet Group Spa: Insufficient legal basis for data processing
- GEDI News Network Spa: Insufficient legal basis for data processing
- ParkkiPate Oy: Insufficient fulfilment of data subjects rights
- A. ΕΠΙΛΟΓΗ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ: Non-compliance with general data processing principles
- TECNOMEDICAL S.r.l.: Insufficient fulfilment of data subjects rights
- Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros Moschato: Insufficient legal basis for data processing
- Rhodes Municipal Transport Company: Insufficient fulfilment of data subjects rights
- BELGIUM DPA: Insufficient fulfilment of data subjects rights
- Εγνατία Οδός Α.Ε.: Insufficient fulfilment of data subjects rights
- Corporation: Insufficient fulfilment of data subjects rights
- Medicina & Lavoro s.r.l.: Insufficient fulfilment of data subjects rights
- Studio Colli Aniene Verderocca S.r.l.: Insufficient fulfilment of data subjects rights
- IKEA România S.R.L.: Insufficient fulfilment of data subjects rights
- Palumbo Superyacht Ancona s.r.l.: Insufficient legal basis for data processing
- E-Mac Professional s.r.l.: Insufficient fulfilment of data subjects rights
- Afragola municipality: Non-compliance with general data processing principles
- Federazione Italiana Nuoto: Insufficient fulfilment of data subjects rights
- Health insurance provider: Non-compliance with general data processing principles
- Cosmopol Security S.p.A.: Insufficient fulfilment of data subjects rights
- Deutsche Bank S.p.A.: Insufficient fulfilment of data subjects rights
- Colosseo S.r.l.: Insufficient fulfilment of data subjects rights
- Codess Sociale, Soc. Coop. sociale.: Insufficient fulfilment of data subjects rights
- Viking Line Oy Abp: Non-compliance with general data processing principles
- Alektum Oy: Insufficient fulfilment of data subjects rights
- Poste Italiane S.p.a.: Insufficient fulfilment of data subjects rights
- Azienda Sanitaria Locale di Brindisi: Insufficient fulfilment of data subjects rights
- Mister Brick S.a.s.: Insufficient legal basis for data processing
- Manager of a real estate co-ownership: Insufficient legal basis for data processing
- Physician: Insufficient fulfilment of data subjects rights
- Company: Insufficient fulfilment of data subjects rights
- Tensa Art Design SA: Insufficient fulfilment of data subjects rights
- Sorgenia S.p.a.: Insufficient technical and organisational measures to ensure information security
- NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε.,: Insufficient fulfilment of data subjects rights
- Santander Consumer Bank S.p.a.: Insufficient fulfilment of data subjects rights
- Company: Insufficient fulfilment of data subjects rights
- H&M Hennes & Mauritz GBC AB: Insufficient fulfilment of data subjects rights
- Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb: Insufficient fulfilment of data subjects rights
- Hora Credit IFN SA: Insufficient technical and organisational measures to ensure information security
- Techno Security s.r.l.: Insufficient fulfilment of data subjects rights
- Alpha Bank: Insufficient fulfilment of data subjects rights
- Owners' association: Non-compliance with general data processing principles
- Wi-Planet sas di Torri Carlo Alberto e c.: Insufficient fulfilment of data subjects rights
- Banca di Credito Cooperativo Appulo Lucana soc. cooperativa: Insufficient fulfilment of data subjects rights
- Ambitious People Group B.V.: Insufficient fulfilment of data subjects rights
- Azzurro Club Hotels S.r.l.: Insufficient legal basis for data processing
- Polisportiva Mimmo Ferrito s.r.l..: Insufficient fulfilment of data subjects rights
- Brivio Limited: Insufficient fulfilment of data subjects rights
- Medical association: Insufficient fulfilment of data subjects rights
- Rossi Carta S.r.l.: Insufficient fulfilment of data subjects rights
- TS Food Processing s.r.l.: Insufficient fulfilment of data subjects rights
- PPC ENERGIE MUNTENIA S.A.: Insufficient fulfilment of data subjects rights
- Attorney: Insufficient fulfilment of data subjects rights
- SC Class IT Outsourcing SRL: Insufficient fulfilment of data subjects rights
- Vodafone România SA: Insufficient fulfilment of data subjects rights
- Top Quality Corporation s.r.l.s.: Insufficient fulfilment of data subjects rights
- Untold SRL: Insufficient fulfilment of data subjects rights
- Blackcab Systems SRL: Insufficient fulfilment of data subjects rights
- Hera Comm S.p.A.: Non-compliance with general data processing principles
- CA Autobank S.p.A.: Insufficient fulfilment of data subjects rights
- Credit Institution: Insufficient fulfilment of data subjects rights
- Company: Non-compliance with general data processing principles
- Interflora Italia S.p.A.: Insufficient legal basis for data processing
- Orange Romania SA: Non-compliance with general data processing principles
- PPC Energie Muntenia SA: Insufficient legal basis for data processing
- ONE UNITED PROPERTIES S.A: Insufficient legal basis for data processing
- Bucharest Down Town Hotel SRL: Insufficient fulfilment of data subjects rights
- SC Travel Planner SRL: Insufficient technical and organisational measures to ensure information security
- Xiting ROM SRL: Insufficient fulfilment of data subjects rights
- SC Piramida Trade Invest SRL: Non-compliance with general data processing principles
- Order of Biochemists, Biologists and Chemists in the Romanian Health System: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient legal basis for data processing
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Università degli Studi di Cassino e del Lazio Meridionale: Non-compliance with general data processing principles
- Dr. Max SRL: Insufficient fulfilment of data subjects rights
- Agency for Control of Outstanding Debts S.R.L.: Insufficient fulfilment of data subjects rights
- Comune di Nichelino: Insufficient legal basis for data processing
- Comune di Isola del Gran Sasso: Insufficient legal basis for data processing
- Whitedecor SRL: Insufficient legal basis for data processing
- La Prima Srl: Insufficient legal basis for data processing
- Crowd Entertainment Limited: Insufficient fulfilment of data subjects rights
- Verisure Italy s.r.l.: Non-compliance with general data processing principles
- Art. 16 GDPR requires formal rectification request; vague tweet does not suffice
- One-Stop-Shop case digest on right of access
- Coordinated Enforcement Action, implementation of the right of access by controllers
- Study on the secondary use of personal data in the context of scientific research
- Opinion 3/2025 on the draft decision of the French Supervisory Authority (FR SA) regarding the “Lexing GDPR certification criteria”
- Österreichische Datenschutzbehörde v CRIF
- Natural Person: Non-compliance with general data processing principles
- Alliance for the Union of Romanians (AUR) Party: Insufficient fulfilment of data subjects rights
- Bressanelli Galli Gelpi Porta & C. S.r.l.: Insufficient legal basis for data processing
- Sportitalia Società Sportiva Dilettantistica a.r.l.: Insufficient fulfilment of data subjects rights
- I Mathisi: Insufficient fulfilment of data subjects rights
- Banco Bilbao Vizcaya Argentaria SA: Insufficient fulfilment of data subjects rights
- KEAT - Centre for Education & Rehabilitation of the Blind: Insufficient fulfilment of data subjects rights
- Elkjøp AS: Insufficient legal basis for data processing
- Coordinated Enforcement Action,
- ANSPDCP (Romania) - Fine against Ascendex Technology SRL
- Munich Court: §11(8) RBStV validly restricts Art. 15 GDPR access for broadcasting
- NAIH: School grades are personal data; failure to provide access in eKRÉTA system
- HDPA (Greece) - 54/2024
- EDPB Annual Report 2023
- Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria
- Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)
- EDPB Annual Report 2022
- EDPB Annual Report 2021
- EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act)
- Austrian Fed Admin Court: AMS access response omitted 2018 family doctor call note
- TR v Land Hessen
- Proximus NV v Gegevensbeschermingsautoriteit
- Ligue des droits humains ASBL v Conseil des ministres
- Tele2 (Netherlands) BV and Others v Autoriteit Consument en Markt (ACM)
- Athanassios Oikonomopoulos v European Commission
- APD/GBA (Belgium) - 97/2026
- AEPD (Spain) - PS-00159-2025
- HDPA (Greece) - 33/2020
- OLG München - 36 U 1054/25 e
- Garante per la protezione dei dati personali (Italy) - 483/2026
- Garante per la protezione dei dati personali (Italy) - 476/2026
- NAIH (Hungary) - NAIH-4462-5-2026
- Datatilsynet (Denmark) - 2023-31-0321
- Garante per la protezione dei dati personali (Italy) - 556/2026
- Rotterdam court upholds municipality's refusal of excessive GDPR requests
- Garante per la protezione dei dati personali (Italy) - 10269624
- DSB (Austria) - DSB-D124.5337
- Datatilsynet reprimands Danish Tax Administration for access request delays (2019-2024)
- NSS - 4749/2026
- VG Osnabrück - 7 A 170/24
- High Court examines DPA inquiry into Meta's refusal of raw data access and portability
- BVwG - W605 2289290-2/18E
- Garante warns ReLife Recycling for failing to timely respond to GDPR access request
- Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR
- Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR
- Leontinoi Società Cooperativa Sociale: Insufficient fulfilment of data subjects rights