Every loyalty card, insurance policy and social account leaves behind a record of personal data that most people never get to inspect. European privacy law offers a direct route into that record: Article 15 of the GDPR entitles anyone to ask an organisation whether it processes their data, to receive a copy at no cost and to learn who else has seen it. The organisation then has one month to reply.
- Free first copy: the initial response costs nothing, though further copies may carry a reasonable administrative fee.
- One-month clock: the deadline can stretch by two extra months only for complex or numerous requests, with notice inside the first month.
- No explanation required: you never have to justify why you want your own data.
- Clear escalation path: silence or an incomplete answer opens the door to a complaint with the national supervisory authority.
What Article 15 actually puts in your hands
The obligation goes far beyond a bare list of fields. The controller must confirm whether it processes your data and, if it does, supply a copy alongside a set of explanations:
- The purposes behind the processing and the categories of data involved.
- The recipients who have received or will receive the data, including destinations outside the EU and the safeguards attached to those transfers.
- The retention period, or the criteria used to decide it when no fixed term exists.
- Where the data came from, if it was not collected directly from you.
- Whether automated decision-making or profiling is applied, plus meaningful information about the logic and the consequences of that logic.
- A reminder of your rights to rectification, erasure, restriction and objection, and of your right to lodge a complaint with a supervisory authority.
Requests submitted electronically should be answered in a commonly used electronic format unless another arrangement was requested.
Choosing the recipient and drafting the request
The request belongs with the data controller — the company or body that actually holds the records. Spain’s data protection authority, the AEPD, makes the point bluntly in its own guidance: it does not hold citizens’ data and cannot deliver it. A privacy policy normally names a channel for exercising rights or the contact details of a data protection officer. Using that route simplifies matters, but it is not compulsory. The European Data Protection Board’s Guidelines 01/2022 on the right of access confirm that the GDPR imposes no formal requirements on the person asking, so a message to an official contact point is sufficient.
The AEPD publishes a ready-made access request form that already covers everything Article 15 lists and restates the one-month deadline. Three practical details are worth knowing before hitting send:
- Motives are irrelevant. The EDPB states plainly that applicants need not explain themselves, and the company is in no position to judge whether the information will be useful.
- ID copies should not be the default. Demanding a scan of an identity document is considered disproportionate when the company has already authenticated the person, for instance through the credentials used to open a customer account. Verification can be handled electronically without storing document copies; genuine doubts about identity do allow a request for extra information under Article 12.6.
- Keep evidence of dispatch. Any later complaint will require the original request, the reply and proof that the company received it.
One caution: firing off the same demand every month is counterproductive. Guidance attached to the official form warns that exercising the right more than once in six months without legitimate cause may be treated as repetitive, and Article 12.5 permits a fee or refusal for manifestly excessive requests.
Deadlines, extensions and complaints
Article 12.3 sets the rhythm. The controller must answer without undue delay and at the latest within one month of receipt. That period can be extended by two further months where the request is complex or numerous, provided the applicant is informed within the first month with an explanation. A refusal must also arrive inside that window, with reasons and a reminder that the matter can be taken to a supervisory authority or to court.
The EDPB adds a useful nuance: the response should reflect the data as it stood when the request was received, even where that data is inaccurate. Once the month passes without an answer, or the answer is incomplete, a complaint can be filed with the AEPD, which runs a dedicated channel for unattended rights requests through its electronic headquarters. Attach the request, any response and proof of receipt — without them the file stalls.
Self-service downloads are not the same thing
Platform exports feel similar but deliver less. Google Takeout, for example, lets users select products such as mail, documents, calendar entries, photos and YouTube videos, then sends a link by email or drops the archive into Drive or Dropbox; the file expires after roughly seven days and the process can take anything from minutes to several days. Google itself notes that downloading data does not remove it from its servers. What an export returns is content, not the purposes, recipients, retention schedules or profiling logic that Article 15 obliges a company to disclose.
Why the access right deserves more use
Article 15 is arguably the most underused tool in the GDPR, and simultaneously the most powerful, because rectification, erasure and objection all depend on first knowing what is stored. It performs best against services whose collection is invisible — voice assistants holding recordings, connected cars logging location and driving habits — where the answer will be long and dry, yet still amounts to the cheapest privacy audit available to any consumer. As connected products multiply and data practices grow more opaque, the formal request is likely to become a routine consumer habit rather than a niche legal manoeuvre.