Regulation and data
Right of access
The right of access lets anyone find out whether a controller processes data about them and, if so, obtain a copy and information on what they are used for, what kind they are, who receives them, how long they are kept and where they came from. Art. 15 of the GDPR governs it, and there is one month to reply.
Also known assubject access request · copy of personal data · derecho de acceso
What has to be handed over
The reply has two parts: the copy of the data (art. 15.3) and the information in art. 15.1. The deadline is one month from the request, extendable by two more if it is complex (art. 12.3). The information covers:
- The purposes of the processing and the categories of data.
- The recipients, particularly those outside the EU, and the safeguards for that international transfer (art. 15.2).
- The retention period, or the criteria used to set it.
- The other rights —rectification, erasure, restriction, objection— and the right to complain to the supervisory authority.
- The source of any data the person did not provide, and whether there is automated decision-making.
Worth knowing
The copy must not drag other people along (art. 15.4). If a resident's fault report mentions their roommate, that is reviewed before it is handed over, and dumping the whole centre's records to answer one person would be a breach. The first copy carries no charge (art. 15.3). Spain's LOPDGDD allows the controller to ask for the request to be narrowed down when there are many data (art. 13.1) and to treat as repetitive one repeated within six months with no legitimate reason (art. 13.3). If what the person wants is to take the data elsewhere, that is portability.
Sources
Related terms
- Right to erasureThe right to erasure, or right to be forgotten, lets a person have the controller delete their personal data without undue delay if they are no longer needed, if the consent they rested on is withdrawn, if the person objects to the processing or if they were processed unlawfully. Art. 17 of the GDPR governs it.
- Right to data portabilityPortability is the right to receive the personal data one has provided to a controller in a structured, commonly used, machine-readable format, and to pass them to another controller, directly where feasible. It applies where processing is automated and based on consent or a contract (art. 20 of the GDPR).