Table of Contents
Understanding Article 15 of GDPR
The objective of Article 15 of GDPR is to grant an important right to individuals regarding access to their personal information.
Individuals have the right to obtain information about what type of personal data companies have on them and ultimately get access to such data.
Right to obtain access to personal data (Article 15(1) GDPR)
Article 15 obligates companies to provide individuals with confirmation about whether or not they process personal data.
If companies do process personal data, Article 15(1) makes it possible for individuals to demand access to the personal data to get the following clarifications:
- What is the purpose of processing their personal data (Article 15(1)(a) GDPR)
- What type of category of personal data is processed (Article 15(1)(b) GDPR)
- The recipients of the personal data and if they are in third countries (Article 15(1)(c) GDPR)
- How long is personal data stored or intended to be stored (Article 15(1)(d) GDPR)
- Disclosure of the individual’s right to demand the rectification of data, its erasure, restrict its processing or object to such processing (Article 15(1)(e) GDPR)
- If the personal data was obtained from another source other than directly from the data subject, the source of the data (Article 15(1)(f) GDPR)
- The existence of any automated decision-making, including profiling, along with information about the logic and impact on the data subject (Article 15(1)(g) GDPR)
Personal data transferred to third countries (Article 15(2) GDPR)
GDPR gives individuals the right to know if their personal data is being transferred outside of the European Union to third countries and what type of measures are implemented to protect and safeguard the personal data.
Copy of personal data processed (Article 15(3) GDPR)
Companies are obligated to provide a copy of the personal data they process to individuals demanding it.
The first copy is free.
For any subsequent copies, companies may charge an administration fee.
Right and freedom of third parties (Article 15(4) GDPR)
When a person requests a copy of the data undergoing processing by a data controller, the controller must make sure that the rights and freedoms of other persons are not affected by the exercise of this right.
Recitals applicable to Article 15 of GDPR
Relevant Recitals: 63, 64
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 15 or relevant recitals
None
GDPR Text: Article 15 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection Regulation
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
