Right of Access Procedures

Legal Framework

The right of access is enshrined in Article 8(2) of the EU Charter and operationalised by Article 15 GDPR. Article 15 grants data subjects a two-tier right: first, confirmation of whether their personal data are being processed, and second, where processing is occurring, access to the data together with a prescribed catalogue of supplementary information — including processing purposes, categories of data, recipients, retention periods, and the existence of automated decision-making.

"The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:"
— GDPR Art. 15(1)

Recital 63 frames the right's purpose: enabling data subjects to verify the lawfulness of processing. It also signals limits — the right must not unduly prejudice trade secrets or intellectual property — while warning that such considerations "should not be a refusal to provide all information." Where personal data are transferred to third countries, Article 15(2) adds a discrete obligation to inform the data subject of the appropriate safeguards under Article 46. Article 15(3) entitles the data subject to a copy of the processed data.

Key Developments

The CJEU's ruling in Minister voor Immigratie v. M (2014) established foundational parameters for access scope. The Court held that access extends to all personal data processed by the controller but does not encompass legal analysis or administrative reasoning beyond what constitutes personal data. Critically, the Court confirmed that compliance can be achieved through a summary, provided it is intelligible and enables the data subject to verify accuracy and exercise downstream rights.

"an applicant for a residence permit has a right of access to all personal data concerning him which are processed by the national administrative authorities"
— Minister v. M ¶60

The earlier X judgment (2013) set procedural benchmarks, requiring that access be provided without constraint, excessive delay, or excessive expense — a standard carried forward into Article 12(3) GDPR. Enforcement actions confirm these are not merely aspirational: the Irish DPA fined Permanent TSB €277,500 for insufficient measures to fulfil access requests, and the Estonian DPA acted against a dental clinic that failed to properly respond to a data subject's access complaint.

Status of the Debate

This topic is actively contested. While the core entitlement under Article 15 is well-established, courts and regulators continue to grapple with boundary questions: what constitutes "personal data" in mixed legal-factual records (per Minister v. M), how to balance trade-secret protection against the access right (Recital 63's tension), and what format satisfies the "intelligible form" standard. National derogations under Article 89(2)–(3) for archival and research purposes further fragment the landscape, as Member States may restrict access rights in those contexts. The EDPB's ongoing guidelines on right of access signal that regulator-level clarification is still evolving. Resolution will likely require further CJEU guidance on the precise scope of "copy" under Article 15(3) and the proportionality test when third-party rights intersect with access requests.

Practical Guidance

• Verify identity proportionately: Before responding, confirm the requester's identity using reasonable means — do not demand excessive documentation that would itself constitute a barrier to access, consistent with the X standard of access "without constraint."
• Distinguish personal data from legal analysis: Following Minister v. M, provide access to all personal data but exclude purely legal reasoning or administrative analysis that does not itself constitute personal data, unless it contains personal data embedded within it.
• Deliver in intelligible form: A full summary may satisfy the obligation if it allows the data subject to become aware of the data and verify accuracy — but ensure the summary is complete and comprehensible, not merely a data dump in raw format.
• Include all Article 15(1) supplementary information: Beyond the data itself, provide processing purposes, recipient categories, retention periods, source information (where data were not collected from the subject), and details of any automated decision-making.
• Document third-party and trade-secret redactions: Where redactions are applied to protect others' rights, record the specific legal basis and ensure the data subject still receives meaningful information — a blanket refusal will not survive scrutiny.