What must I do when I receive an access request?

One month to respond to a request for access

When someone requests access to their personal data, the starting point is that you respond within the one-month period set out in Article 12 GDPR. This period runs from the moment the request is received, and the data subject does not need to provide a reason — the right of access under Article 15 GDPR is independent of justification. In certain cases, Article 12 GDPR allows for an extension of this period, provided this is communicated to the data subject in time and with an explanation.

In practice, this means first establishing whether the requester is indeed the person whose data is in question, and then determining which personal data relating to that person are being processed. Article 15 GDPR specifies what the response should include: among other things, the purpose for which the data are processed, which categories of data are involved, who they have been or will be shared with, and how long they will be kept. An overview that covers these points, in understandable language, counts as a way to comply with a request for access.

Where this is based: Articles 15 and 12 GDPR

The right of access stems from Article 15 GDPR and the corresponding response period from Article 12 GDPR; these provisions apply as part of a regulation directly and uniformly in every Member State, so the core of this obligation does not differ between the Netherlands and Germany. What does differ is who a data subject can approach if they believe their request has been handled incorrectly: in the Netherlands this is the Dutch Authority for Personal Data, in Germany it is the supervisory authority of the state where the establishment is located. The Dutch Authority for Personal Data provides an explanation on its page about privacy rights regarding this right and how it is handled.