The right to access information

(Article 15 of the GDPR)

You have the right to obtain the following from the data controller:

1. Confirmation of whether or not personal data concerning you is being processed

2. Where personal data concerning you is being processed, a copy of your personal information

3. Where personal data concerning you is being processed, other additional information as follows:

  1. Purpose(s) of the processing
  2. Categories of personal data
  3. Any recipient(s) of the personal data to whom the personal data has or will be disclosed, in particular recipients in third countries or international organisations and information about appropriate safeguards
  4. The retention period or, if that is not possible, the criteria used to determine the retention period
  5. The existence of the following rights:
    • Right to rectification
    • Right to erasure
    • Right to restrict processing
    • Right to object
    • and information on how to request these from the controller.
  6. The right to raise a concern with a supervisory authority (in Ireland this is the Data Protection Commission)
  7. Where personal data is not collected from the data subject, any available information as to their source
  8. The existence of automated decision making, including profiling and meaningful information about how decisions are made, the significance and the consequences of processing.

 

The GDPR states that the right to obtain a copy of your personal data must not adversely affect the rights and freedoms of others. This means that the right cannot be used to access the personal data of other persons, i.e. third parties.

There are also a number of other restrictions to the right of access, provided for by section 60 of the Data Protection Act 2018.

How can I make a request under the Right to Access my personal data?

While the GDPR does not specify any particular format in which you should make an access request, the DPC has provided the below template for access requests that are made to the Data Controller in writing:

Dear...

I wish to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of any information you keep about me, on computer or in manual form in relation to...

Please be as specific as possible in relation to the personal data you wish to access. You may be asked to provide evidence of your identity. This is to make sure that personal information is not given to the wrong person. Further information on how long it will take, how much it will cost, how the information will be provided, and how to raise a concern with the DPC if you are unhappy with the outcome is available by clicking the menu links on the left hand side of this page.

Can the data controller charge a fee to provide a copy of the information?
No, the data controller must provide a copy of the information for free. However, if any further copies are requested by the data subject, or if the request is manifestly unfounded or excessive, the controller may charge a reasonable fee based on the administration costs.

What happens if you make the access request by electronic means (e.g. email)?
The information must be provided in electronic form, unless otherwise requested by you.