Laws · GDPR ·art-15-par-1 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Full text
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
How it connects
Cited by
- Drivers' Request for Personal Data Access and Automated Decision-Making Information from Ola Netherlands BV: Balancing Personal Data Protection with the Needs of Drivers
- Uber Drivers Request Access to Personal Data and Disclosure of Automated Decision-Making: Balancing Privacy with Passenger Safety
- Guidelines 01/2022 on data subject rights - Right of access
- Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them
- Guidelines 8/2020 on the targeting of social media users
All 150
- Employer: Insufficient fulfilment of data subjects rights
- Bank (name not available at the moment): Insufficient fulfilment of data subjects rights
- Vodafone Italia S.p.A.: Non-compliance with general data processing principles
- BELGIUM DPA: Insufficient fulfilment of data subjects rights
- CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights
- Pediatrician: Insufficient fulfilment of data subjects rights
- Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ: Insufficient fulfilment of data subjects rights
- National Bank of Greece: Insufficient fulfilment of data subjects rights
- ΛΙΜΕΝΟΣ ΗΡΑΚΛΕΙΟΥ Α.Ε.: Insufficient fulfilment of data subjects rights
- Medical clinic: Insufficient fulfilment of information obligations
- HEI – Medical Travel: Insufficient fulfilment of data subjects rights
- Viking Line Oy Abp: Non-compliance with general data processing principles
- Alektum Oy: Insufficient fulfilment of data subjects rights
- Manager of a real estate co-ownership: Insufficient legal basis for data processing
- Deutsche Kreditbank: Insufficient fulfilment of data subjects rights
- TIM S.p.A.: Insufficient legal basis for data processing
- Spotify: Insufficient fulfilment of data subjects rights
- MALTA DPA: Insufficient fulfilment of data subjects rights
- CRITEO: Insufficient fulfilment of data subjects rights
- Piraeus Bank: Non-compliance with general data processing principles
- NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε.,: Insufficient fulfilment of data subjects rights
- Alpha Bank: Insufficient fulfilment of data subjects rights
- Company: Insufficient fulfilment of data subjects rights
- Blackcab Systems SRL: Insufficient fulfilment of data subjects rights
- Netflix International B.V.: Insufficient fulfilment of information obligations
- Company: Non-compliance with general data processing principles
- Xiting ROM SRL: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient legal basis for data processing
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Legal Person: Insufficient fulfilment of data subjects rights
- Company: Insufficient fulfilment of data subjects rights
- NN Greek Single-Member Anonymous Life Insurance Company: Insufficient fulfilment of data subjects rights
- Fan Courier Express S.R.L.: Insufficient fulfilment of data subjects rights
- Company: Insufficient fulfilment of data subjects rights
- Crowd Entertainment Limited: Insufficient fulfilment of data subjects rights
- One-Stop-Shop case digest on right of access
- Coordinated Enforcement Action, implementation of the right of access by controllers
- EDPB Annual Report 2024
- Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation
- Digital Rights Ireland Ltd v Minister for Communications
- Privacy International v Secretary of State
- Österreichische Datenschutzbehörde v CRIF
- SO Warszawa: Controller warned for violating GDPR Arts. 5(1), 6(1), and 15(1)
- Timegrip AS: Insufficient fulfilment of data subjects rights
- Rb. Den Haag - C/09/689833
- Suomen Numerokeskus Oy: Insufficient fulfilment of data subjects rights
- I Mathisi: Insufficient fulfilment of data subjects rights
- KEAT - Centre for Education & Rehabilitation of the Blind: Insufficient fulfilment of data subjects rights
- Isabel SA: Insufficient fulfilment of data subjects rights
- OLG Wien - 13R70/25x
- Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED
- The Court of Justice on the Excessiveness of Access Requests under the GDPR
- AG Arnsberg - 42 C 434/23
- CJEU - C-526/24 - Brillen Rottler
- Munich Court: §11(8) RBStV validly restricts Art. 15 GDPR access for broadcasting
- NAIH: School grades are personal data; failure to provide access in eKRÉTA system
- CJEU - C-350/21 - Spetsializirana prokuratura (Retention of traffic and location data)
- CE - N. 433539
- CJEU - C-511/18 - La Quadrature du Net and Others
- GC T-318/24: EPSO access logs and Article 17 access requests under Regulation 2018/1725
- OVG Saarlouis - 2 A 165/24
- Dutch Supreme Court: patient not entitled to access peer-review assessment of medical file
- BfDI: Telekom must name all recipients, data origin and deletion dates in Art. 15 replies
- CNIL (France) - SAN-2022-011
- EWCA - Dawson-Damer v Taylor Wessing LLP
- EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro
- EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
- EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse
- Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria
- Opinion 20/2021 on Tobacco Traceability System
- Austrian Fed Admin Court: AMS access response omitted 2018 family doctor call note
- European Data Protection Supervisor v Single Resolution Board
- Philippe Latombe v European Commission
- CK v Magistrat der Stadt Wien
- C.G. v Bezirkshauptmannschaft Landeck
- Criminal proceedings against HYA and Others
- La Quadrature du Net and Others v Premier ministre and Ministère de la Culture
- Criminal proceedings against Unknown individuals
- Criminal proceedings against M.N
- A. G. v Lietuvos Respublikos generalinė prokuratūra
- Proceedings brought by J.M
- HYA and Othersprokuratura
- RW v Österreichische Post AG
- Bundesrepublik Deutschland v SpaceNet AG and Telekom Deutschland GmbH
- Criminal proceedings against VD bd]&
- G.D. v The Commissioner of the Garda Síochána and Others
- Criminal proceedings against HP
- Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA
- Criminal proceedings against H. K
- VQ v Land Hessen
- European Commission v Ireland
- Proceedings brought by Ministerio Fiscal
- Maximilian Schrems v Facebook Ireland Limited
- Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy
- Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others
- X
- Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others
- LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten GmbH v Tele2 Telecommunication GmbH
- Ireland v European Parliament and Council of the European Union
- The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how
- APD/GBA (Belgium) - 97/2026
- BVwG - W254 2253353-1
- HDPA (Greece) - 33/2020
- OLG München - 36 U 1054/25 e
- Garante per la protezione dei dati personali (Italy) - 483/2026
- BAG - 8 AZR 169/25
- VG Berlin - 42 K 25/25
- Datatilsynet (Denmark) - 2023-31-0321
- MEDE S.A.: Non-compliance with general data processing principles
- Market-In: Non-compliance with general data processing principles
- DSB: Retailer must grant full access and delete data after third-party fraud order
- DSB: No processor access violation under Art. 15 GDPR when controller deleted data
- DSB (Austria) - DSB-D124.5337
- Datatilsynet reprimands Danish Tax Administration for access request delays (2019-2024)
- VG Osnabrück - 7 A 170/24
- DSB (Austria) - DSB-D124.2437/25
- High Court examines DPA inquiry into Meta's refusal of raw data access and portability
- BVwG: Data protection complaint by litigation-funded enforcement association inadmissible
- VG Munich: university may be GDPR controller for professors' editorial work emails
- BVwG - W254 2253351-1
- BVwG - W605 2289290-2/18E
- Lidl Italia S.r.l.: Insufficient fulfilment of data subjects rights
- CNIL fines EXTIA for failing to properly handle job applicant erasure requests
- Estonian DPA: website republishing public authority documents independently liable under
- ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.): Insufficient fulfilment of data subjects rights
- Austrian DSB: Google failed to provide complete data in YouTube access request
- ANSPDCP (Romania) - Spitalul Veterinar Tineretului SRL
- DSB: Google LLC failed to provide complete data in YouTube access request
- Brillen Rottler GmbH & Co. KG v TC
- WS v European Commission
- La Quadrature du Net and Others v Premier ministre and Others
- Bonnier Audio AB and Others v Perfect Communication Sweden AB
- Scarlet Extended SA v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM)
- College van burgemeester en wethouders van Rotterdam v M. E. E. Rijkeboer
- Productores de Música de España (Promusicae) v Telefónica de España SAU
- European Parliament v Council of the European Union (C-317/04) and Commission of the European Communities (C-318/04)