Anyone who wants to know which data a company has stored about them can request access under the General Data Protection Regulation (GDPR). This right is little known in everyday life, yet it is an effective way to gain transparency about customer accounts, orders, applications or advertising profiles. This guide explains what you can request, which deadlines apply and how to respond if the answer is missing or incomplete.
Short answer: Under Article 15 GDPR you can ask a company to confirm whether it processes personal data about you and to provide that information. The answer is generally due within one month. If the request is complex or numerous, the period can be extended by two further months, but the company must inform you within the first month of the extension and its reasons (Article 12 para. 3 GDPR). Status of the information: July 2025, information sheet of the State Commissioner for Data Protection of Lower Saxony.
The most important points at a glance
- The right of access under Article 15 GDPR belongs to every data subject whose data is processed.
- The answer is generally due within one month after the request is received.
- The information includes, among other things, a copy of your data, the purposes of processing and the recipients.
- A negative answer also counts: the company must confirm when it holds no data about you.
- If no answer arrives or it is incomplete, you can turn to the data protection supervisory authority.
What is the right of access?
The right of access allows you to learn from a controller whether it processes personal data about you. If it does, you can request the data itself as well as further information about the processing. The right is addressed to the controller, which is the company or body that decides on the purposes and means of processing.
The purpose of the access right is transparency. You learn which data exists, where it comes from, to whom it was passed on and how long it is meant to be stored. Online services, insurers and contract portals are particularly worth checking, because they often accumulate more data than people expect.
Which information must you receive?
The answer is more than a copy. The information sheet of the State Commissioner for Data Protection of Lower Saxony lists the components that Article 15 para. 1 GDPR provides for. The table below summarises them.
| Component | What you should learn |
|---|---|
| Confirmation of processing | Whether personal data about you is processed, including a negative answer |
| Copy of the data | A copy of the personal data that is being processed |
| Purposes of processing | What the data is used for |
| Categories of data | Which types of data are concerned |
| Recipients | Which recipients or categories of recipients have received or will receive the data |
| Storage period | How long the data is meant to be stored, or the criteria for that period |
| Rights and complaints | Information on rectification, erasure, restriction, objection and complaints to the supervisory authority |
| Origin | Where the data comes from, if it was not collected from you directly |
| Profiling | Information on automated decision-making, including profiling |
| Transfers to third countries | Information on safeguards if data is transferred outside the EU |
How do you make the request correctly?
A carefully worded request makes the company’s job easier and your later review simpler. It does not need to be elaborate, but it should be unambiguous. State your full name, any customer numbers or email addresses under which you are known and the period for which you want information. Refer expressly to Article 15 GDPR.
- Find the contact address for data protection requests in the provider’s privacy policy.
- Write the request in text form, cite Article 15 GDPR and list the information you expect.
- Note the date of sending so that you can calculate the one-month period reliably.
- Attach proof of identity if the company has doubts about who you are, and record which details you provided.
- Check the answer against the list in Article 15 GDPR and note anything missing.
Which deadlines apply?
The deadline is the point where most requests reveal gaps. The information sheet sets a clear framework that you should build into your planning.
| Point in time | What applies | Basis |
|---|---|---|
| Receipt of the request | The one-month period begins with receipt of the request | Article 12 para. 3 GDPR |
| Within the first month | The information must be provided, or the company notifies an extension and gives reasons | Article 12 para. 3 GDPR |
| After one month | Without an extension, the answer is late | Article 12 para. 3 GDPR |
| Extension | By two further months, if complexity or the number of requests requires it | Article 12 para. 3 GDPR |
What do you do if the answer does not arrive?
If the deadline has passed without an answer or without a justified extension, remind the company in writing of your request and set a short further deadline. If that also yields no result, you can turn to the competent data protection supervisory authority. The information sheet names this right of complaint explicitly as part of the information.
An incomplete answer is also a reason to follow up. Compare the response with the list above. If the origin of the data or the details on recipients is missing, name exactly those points in your letter. A precise follow-up usually produces results faster than general frustration.
Frequently asked questions
What is a negative answer?
A negative answer means that the company confirms it holds no personal data about you. This answer also belongs to the information under Article 15 GDPR and is therefore a full result. It gives you certainty if you were once in contact with a service that no longer keeps data.
Do I receive a copy of my data?
Yes. According to the information sheet, the access includes a copy of the personal data that is being processed. You should name the desired format explicitly in your request, for example an electronic file, so that you do not receive only an overview without content.
What does profiling mean in the answer?
Profiling means the automated evaluation of personal characteristics, for example to assess interests, creditworthiness or behaviour. According to the information sheet, the answer must include information on automated decision-making, including profiling. If a service shows you advertising or credit decisions, this is exactly the point to ask about.
Do I have to make a separate request to each service?
Yes. Each body that holds data about you is a controller in its own right. A request to one provider does not automatically cover data held by its partners. Note the services where you had accounts or orders and write to each one separately.
What to do now
- List the services where you had accounts, orders or contracts.
- Send each organisation a written request under Article 15 GDPR stating the information you want.
- Once the answer arrives, check whether all components are included.
- If anything is missing, set a short further deadline and keep all communication in writing.
- If no answer arrives, contact the competent data protection supervisory authority.
Related guides
- Identity theft among students: protection and immediate steps
- Parcel phishing: how to recognise fake delivery notifications
- Phishing losses: does insurance refund the money?
- Consumer rights in everyday life: protection against fraud and unfair contracts
Last updated: November 2026. This guide is general information, not individual advice.
