Guidelines 01/2022 on data subject rights - Right of access

• Jurisdiction: European Union
• Date: 17 April 2023
• Year: 2023
• Type of Document: Guidance

September 2025

The General Data Protection Regulation (GDPR) gives individuals

greater control over their personal data by granting them a

series of data subject rights.

One such important right is the right of access, which

allows individuals to request access to the personal data

organisations hold about them. The aim of this right is to

empower individuals to verify the legality and accuracy of

the data processed about them. This will make it easier for

individuals to exercise other rights such as the right to erasure

or rectication.

The EDPB guidelines on data subject rights - right of access

analyse the various aspects of the right of access and provide

precise and practical guidance on how to implement it in

dierent situations.

Access to the personal data held about individuals

When individuals request access to their personal data, they should receive the actual data, not just summaries. They have the

right to access all or part of their data, regardless of its type or source, to understand how it is used. It is key that organisations

ensure the information is complete, accurate, and up-to-date at the time of the request.

2

Access to detailed information about the data processing, including its purpose, the types of data involved,

the recipients, the duration of processing, their rights as individuals, and the safeguards in place

for transfers to third countries

Organisations should inform individuals how their data are processed and what rights they have. They can do so via a privacy

notice or processing records (documented log of personal data processing activities within an organisation). The information

should be updated and tailored to each request.

3

The right of access includes three main components:

Right of access

how to implement it

1Conrmation whether individuals’ personal data are being processed

When individuals request access to their personal data, it is important that organisations rst check if they have any data about

the requester. If not, they can simply conrm that no data are processed. If they do have data, they should conrm this.