GDPR Data Subject Access Request Requirements: A Practical Compliance Guide

Why Article 15 Matters and What It Requires

The right of access is one of the most operationally demanding rights under the GDPR. Article 15 gives individuals the right to obtain confirmation about whether their personal data is processed and, where it is, to receive a copy plus specific information. Article 12 sets the procedural rules: transparent communication, plain language, and a defined response window. Together, these provisions form the core of GDPR data subject access request requirements.

A valid request does not need to cite Article 15 or use a specific form. It can arrive by email, letter, social media, or verbally. The key question is whether the controller can reasonably identify the individual and understand what they are asking for. If yes, the clock starts. If no, the controller may ask for clarification or reasonable identity evidence, but it should not use verification as a delaying tactic.

Under Article 15(1), the response must cover:

• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipient, including third-country recipients;
• the retention period or the criteria used to determine it;
• the data subject's rights, including rectification, erasure, restriction, objection, and complaint to a supervisory authority;
• the source of the data, where it did not come from the data subject;
• the existence of automated decision-making, including profiling, and meaningful information about the logic, significance, and consequences;
• safeguards for transfers outside the EEA under Chapter V.

Article 15(3) adds the right to receive a copy of the personal data undergoing processing. The copy should be complete but must not infringe the rights of others. That is where redaction becomes essential. The controller should provide the information in a concise, intelligible, and easily accessible form, using clear and plain language.

The One-Month Deadline and Extensions

When the response clock starts

The one-month period generally begins when the controller receives the request, not when the data subject first thinks about making it. If the controller needs more information to confirm identity or clarify scope, the clock may be paused in practice, but the controller should tell the individual promptly and document why. Under Article 12(3), the response must be provided without undue delay and in any event within one month.

Complex or numerous requests

For complex or numerous requests, Article 12(3) allows an extension of two further months. The controller must inform the data subject of the extension and the reasons within the initial one-month period. Complex is not a free pass. Large-scale searches, multiple systems, or third-party involvement may justify an extension, but routine requests do not. A practical workflow for GDPR data subject access request requirements should include a documented extension decision and a clear communication log.

Identity Verification, Redaction, and Exemptions

Article 12(6) allows a controller to request additional information where it has reasonable doubts about identity. The request should be proportionate. Asking for a passport copy for a low-risk request may be excessive. Better options include confirming known account details, using an existing authentication method, or asking a targeted question that only the data subject would know.

If the controller processes only minimal data and cannot identify the individual, Article 11 may limit obligations. However, if the data subject provides information enabling identification, the controller must comply. The controller should not demand ID simply because the request is inconvenient. Verification should be risk-based and recorded.

Article 15(4) states that the right to obtain a copy must not adversely affect the rights and freedoms of others. This includes third-party personal data, trade secrets, and confidential business information. Redaction should be targeted. Blanket withholding of entire documents is rarely justified. The controller should explain the legal basis for any redaction, unless doing so would undermine the exemption.

Member State law may restrict the right of access under Article 23 for purposes such as national security, crime prevention, taxation, or legal claims. Legal professional privilege can also apply. Employee access requests often raise mixed data: the employee's own data, colleagues' data, customer data, and management commentary. A consistent redaction protocol and a second review by legal or the DPO reduce risk.

Fees, Format, and Electronic Responses

Article 12(5) makes the first response free of charge in most cases. A reasonable fee may be charged, or the request refused, only where it is manifestly unfounded or excessive. That threshold is high. Repetitive requests may qualify, but the controller must be able to justify the decision with evidence.

If the request was made electronically, Article 12(3) says the information should be provided by electronic means where possible, unless the data subject requests otherwise. Secure portals, encrypted email, or a downloadable archive can work. The format should be accessible. For individuals with disabilities, the controller should consider alternative formats. The response should be written in plain language, not internal codes or unexplained abbreviations.

Operational Checklist for Compliance

Step-by-step workflow

A defensible process turns legal duties into repeatable steps. The following workflow covers the main GDPR data subject access request requirements:

1. Log the request on receipt, including date, channel, and requester details.
2. Verify identity proportionately and record the method used.
3. Clarify scope only where necessary, and confirm any agreed narrowing in writing.
4. Search all relevant systems, including email, CRM, HR, backups, and third-party processors.
5. Review for exemptions, third-party data, and legal privilege.
6. Redact with a clear rationale and a second quality check.
7. Respond within one month, or send an extension notice before the deadline.
8. Document the decision, the data provided, and any refusals.

Controllers should also maintain Article 30 records of processing, train staff to recognize requests, and route them to a central privacy team. A DPO, where appointed, should be involved in complex or contentious cases. Product and engineering teams working on adjacent EU compliance topics—such as EU notified body involvement guide or EU Machinery Regulation 2023/1230 guide—should still treat personal data requests as a separate legal track. The same applies to teams using EU notified body involvement requirements for market access.

Common Pitfalls and Enforcement Risk

Failing to meet GDPR data subject access request requirements can trigger complaints to supervisory authorities and administrative fines under Article 83. The maximum is €20 million or 4% of total worldwide annual turnover, whichever is higher. Real-world enforcement often focuses on late responses, incomplete disclosures, excessive redaction, and failure to explain delays.

Common pitfalls include:

• treating a request as invalid because it does not cite the GDPR;
• asking for excessive identity documents;
• missing data held by processors or in backups;
• disclosing third-party data without redaction;
• charging a fee without a documented manifestly unfounded or excessive assessment;
• failing to inform the data subject about an extension within the first month.

A strong response is not just legally correct; it is clear, timely, and auditable. The controller should be able to show what was searched, what was withheld, and why. That record is the best defense if a supervisory authority asks questions later.