What must a website provide in an Article 15 access response?

The Citead team, updated

In short. A website controller must confirm processing and provide access, a copy and processing information while respecting other people’s rights.

Definition: Under Article 15 of the General Data Protection Regulation (GDPR), a website operator acting as controller must confirm whether it processes a person's personal data and, where it does, provide access to that data, a copy, and information about the processing. The copy must respect other people's rights and freedoms.

Key facts

  • The GDPR's Article 15(1) requires confirmation, access to personal data and information about its processing.
  • The European Data Protection Board's access guidelines include purchase history, activity logs and search activities within the potential scope of access.
  • The Court of Justice's judgment in Case C-487/21 requires a faithful and intelligible reproduction of all personal data undergoing processing.

What information accompanies the personal data?

Personal data means information relating to an identified or identifiable individual under Article 4(1). A controller determines the purposes and means of processing under Article 4(7). For a website operator in that role, Article 15(1) and (2) require information covering:

  • The processing purposes and categories of personal data.
  • Recipients or recipient categories, including recipients in third countries or international organisations.
  • The intended retention period, where possible, or the criteria used to determine it.
  • Rights to request rectification, erasure or restriction, to object to processing, and to complain to a supervisory authority.
  • Available source information when data comes from elsewhere, plus the existence of automated decision-making covered by Article 22(1) and (4), including profiling, with meaningful information about its logic, significance and envisaged consequences.

For transfers to third countries or international organisations, Article 15(2) also requires information about the appropriate safeguards under Article 46.

The EDPB guidelines, version 2.1 dated 30 May 2024, explain that information from a privacy notice may need updating or tailoring to the requester. Unless the person chooses otherwise, actual recipients must be named, subject to the exceptions for impossible identification or manifestly unfounded or excessive requests.

What must the copy contain?

In its judgment of 4 May 2023 in Case C-487/21, the Court of Justice explains that a general description or a list of data categories fails to reproduce the personal data. Copies of document extracts, entire documents or database extracts are required where essential to exercising GDPR rights effectively.

The EDPB guidelines treat an unrestricted request as covering all personal data concerning the requester. Searches extend across IT systems and non-IT filing systems, using criteria such as name or customer number. Incoming and outgoing messages can concern the requester even when they also concern someone else.

The same guidance gives an ecommerce example involving viewed or purchased items. Raw activity data falls within access, and an explanatory document can make codes understandable. Its example uses “A” for an interrupted purchase and “B” for a completed purchase.

How are other people's rights protected?

Article 15(4) requires the copy to respect others' rights and freedoms. Recital 63 includes trade secrets, intellectual property and software copyright among the interests considered.

The EDPB guidelines, paragraphs 172 and 173, require a concrete assessment of adverse effects and a balancing of competing rights. Where possible, information concerning others is rendered illegible while the requester receives their personal data. A general concern about another person's rights is insufficient to justify withholding information.

Related terms

FAQ

Can a website charge for the copy?

Under the GDPR's Articles 12(5) and 15(3), access is ordinarily free, while further copies can attract a reasonable fee based on administrative costs. A manifestly unfounded or excessive request can also attract a reasonable fee or refusal; the controller must demonstrate that character.

What format should an electronic response use?

The GDPR's Article 15(3) requires a commonly used electronic form when you request access electronically, unless you request otherwise. Article 12(1) requires clear, intelligible and easily accessible communication.

How soon must the website respond?

The GDPR's Article 12(3) requires a response without undue delay and within one month. Where necessary because of complexity and request numbers, it permits two further months, with notice and reasons within the initial month.

Sources

  1. European Parliament and Council, "General Data Protection Regulation", 27 April 2016
  2. European Data Protection Board, "Guidelines 01/2022 on data subject rights - Right of access", adopted 28 March 2023, version 2.1 corrected 30 May 2024
  3. Court of Justice of the European Union, "Judgment in Case C-487/21", 4 May 2023

Check how a page reads to answer engines. Open the GEO score analyzer

Test a page and see what to fix first

The analysis usually takes less than 10 seconds and needs no account.

400,000+ pages scored in the public benchmark