Of all the data subject rights in the GDPR, the right of access under Article 15 asks the most of your systems. The deadline is short, the request can arrive through almost any channel, and the data it covers is spread across more places than anyone remembers until they have to search them.
Late answers are rarely caused by a hard request. They come from a request that sat in a shared inbox for a week, an identity check that took another week, and a search that started from nothing.
This article sets out the legal requirements, a process that meets the deadline, and the records that show you met it.
The deadline, precisely
Article 12(3) requires the controller to provide information on action taken "without undue delay and in any event within one month of receipt of the request". The period can be extended by two further months where necessary, taking into account the complexity and number of requests. If you extend, you must tell the data subject within the first month, with the reasons for the delay.
Three things follow:
One month is a ceiling, not a target. "Without undue delay" comes first. A simple request should not wait four weeks.
The clock runs from receipt. The EDPB's guidelines on the right of access say a data subject does not have to use a particular form, or label the request as an access request. A request that reaches your organization through its normal contact points counts.
Extensions are for genuine complexity. A backlog of your own making is not complexity. Decide early, and send the extension notice in writing with reasons.
If you decide not to act on a request, Article 12(4) requires you to say so within one month, with the reasons and the data subject's right to complain to a supervisory authority and to seek a judicial remedy.
Guidance differs on how to count a calendar month, and on whether and when the clock pauses while you verify identity. Ask for any verification on the first day, and the second question rarely matters.
What the response must include
Article 15 gives the data subject a right to three things.
Confirmation of whether you process personal data about them.
A copy of the personal data undergoing processing (Article 15(3)).
Supplementary information, which is wider than people expect:
the purposes of the processing,
the categories of personal data concerned,
the recipients or categories of recipients, in particular recipients in third countries or international organizations,
the envisaged retention period, or the criteria used to set it,
the rights to rectification, erasure, restriction, and objection,
the right to lodge a complaint with a supervisory authority,
where the data was not collected from the individual, any available information about its source,
the existence of automated decision-making, including profiling, with meaningful information about the logic involved and its significance and envisaged consequences, and
where data is transferred to a third country, the appropriate safeguards relied on.
Most of the supplementary information is the same for everyone within a given processing activity. It comes straight from your Article 30 record of processing. If the record is current, this part of the response is assembly, not research.
The first copy is free. Article 15(3) allows a reasonable fee based on administrative costs for further copies. Where the request is made electronically, provide the information in a commonly used electronic form, unless the data subject asks otherwise.
Verifying identity without obstructing the request
Article 12(6) lets you request additional information where you have reasonable doubts about the identity of the person making the request. Two limits apply. The doubt must be reasonable, and the verification must be proportionate.
The EDPB's guidelines warn against asking for more data than verification needs. Demanding a passport copy from a user who writes from the email address on their account is usually disproportionate. Asking them to confirm the request from that address, or through an authenticated session in your product, is usually enough.
Requests made on someone's behalf, by a lawyer or another authorized third party, need evidence of authority. Ask for it once, and say specifically what you need.
A process that meets the deadline
A month is enough time if the work starts on the first day. Build the process so that it does.
Intake. Route every channel to one log: support tickets, the privacy email address, sales contacts, and social media. Train customer-facing staff to recognize an access request in plain language. "Send me everything you have on me" is one.
Log and acknowledge. Record the date received, the requester, the channel, and the deadline. Acknowledge receipt and request any verification in the same message.
Scope the search. Use your record of processing to list every system that holds data about this category of person: customer user, prospect, applicant, or employee. Each system has a named owner who runs the search.
Collect. Export the data from each system. Record who searched what, when, and what they found, including "nothing found".
Review. Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others. Remove or redact third parties' personal data, and check for legal privilege, trade secrets, and any exemption under national law.
Assemble and send. Combine the copy and the supplementary information in a form the individual can read. Send it through a secure channel.
Close. Record the date sent and keep the case file.
Step 3 is where requests overrun. A list of systems per category of data subject, maintained in advance, turns the search into a checklist.
When you are the processor
If an end user of a customer's account sends you an access request about data in that account, you are usually acting as a processor. The controller is your customer. Article 28(3)(e) requires you to assist the controller in responding, but the response is the controller's to give.
Forward the request to the customer promptly. Tell the requester you have done so, if your agreement allows. Support the customer's search with exports or tooling. Your data processing agreement should say how quickly you forward requests and what assistance you provide.
For data you hold as a controller, such as administrators' contact details, billing contacts, and your own marketing lists, the request is yours to answer.
Manifestly unfounded or excessive requests
Article 12(5) allows you to charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, in particular because it is repetitive. The burden of demonstrating that falls on you, and the bar is high.
A request made during a dispute is not unfounded for that reason, and the data subject does not have to explain why they want their data. Repeat requests are also not automatically excessive. Whether a new request is reasonable depends partly on how often the data changes.
Whether a request is manifestly unfounded, and how national exemptions apply to it, are legal judgments. Confirm with counsel before refusing one.
Records that show you met the deadline
Keep a case file for every request, containing:
the date received, the channel, and the requester,
any verification requested and received, with dates,
the systems searched, by whom, and the result,
any extension notice, with reasons and the date sent,
any redactions and the basis for each, and
the response and the date it was sent.
The log of requests is also your evidence that the process works. A supervisory authority investigating a complaint may ask for it, and customers assessing your privacy program may ask how you handle requests and how long they take. A dated log answers both without reconstruction.
How TrustLynce helps
TrustLynce's data privacy workflows log each data subject request with its deadline, track verification and extensions, and assign searches to system owners drawn from your record of processing. Each case keeps the dated file a supervisory authority would ask to see.