Right of access: find out what a company knows about you
Art. 15 GDPR lets you ask any company which data it holds about you, free of charge and without giving reasons. How it works, with a template.
3 min read
You can ask any company for a copy of the data it holds about you. It is free, you do not need a reason, and the company has to answer within one month.
Online shops, your bank, your employer, your landlord, an app you once installed: they all store data about you. Art. 15 GDPR gives you the right to find out exactly what, why and for how long. It is the right on which most other data protection rights build: you can only have data corrected or erased once you know it exists.
What you receive
The company has to confirm whether it processes data about you at all. If it does, you are entitled to:
- a copy of your personal data
- the purposes of the processing
- the recipients, including those outside the EU
- how long the data is stored, or the criteria for it
- where the data comes from, if not from you
- whether automated decisions or profiling are used
- a note on your other rights and on your right to complain
How to ask
- Find the right contact. The privacy notice of the company names it, often an address like privacy@ or a data protection officer.
- Write briefly. An email or a letter is enough; there is no required form. Say that you are asking for access under Art. 15 GDPR.
- Help them find you. Add your customer number, the email address you used or your date of birth. Only if there is reasonable doubt about your identity may the company ask for more.
- Keep a record. Note the date you sent it; the deadline starts then.
You can use our access request template: copy it, fill in the gaps, send it.
Deadlines and costs
The company must answer without undue delay and at the latest within one month. For complex or numerous requests it may extend by two further months, but it has to tell you so, with reasons, within the first month. The first copy is free. For further copies a reasonable fee may be charged.
Where the right ends
The copy must not affect the rights of others, for example personal data of other people or trade secrets. Those parts may be blacked out, but the company cannot refuse the whole answer for that reason. Requests that are manifestly unfounded or excessive, for instance the same request every week, may be refused or charged for.
No answer?
Send one short reminder with a new deadline of, say, two weeks. If that does not help either, you can lodge a complaint with the data protection authority, free of charge. In Austria this is the Datenschutzbehörde; in other EU countries, the authority where you live.
For businesses
Access requests are part of everyday business, and the one-month deadline is short. What helps:
- one person who is responsible and a shared inbox for requests
- a list of the systems where personal data lives: shop, CRM, email, accounting, backups
- a reply template that covers every point listed above
- a log of when each request came in and was answered
If you want us to set this up with you, write to us.
Cookie banners: what Austrian law really requires
Reject must be as easy as accept, and analytics needs consent. What § 165 TKG 2021 and the GDPR require, and a checklist for your website.
2 min read
Data breach: what to do in the first 72 hours
An email to the wrong recipient, a lost laptop, a hacked account: when a data breach must be reported, to whom, and how to stay calm. With a checklist.
2 min read
AI literacy: what Article 4 of the AI Act asks of businesses
Since February 2025, every business that uses AI tools at work has to make sure its people know how to use them. What that means for small businesses, in five steps.
2 min read
Data protection updates
New rules, practical tips and templates for your business, at most once a month.