What do they know about you? How to use your right of access under the GDPR

You were turned down for a loan and do not know why. Your employer uses cameras and an app that tracks your breaks. A clinic refuses to give you your old test results. A shop sends you ads you never signed up for. All of these have a common answer, set out in Article 15 of the General Data Protection Regulation, the GDPR: the right of access.

What you can find out

You have the right to know whether an organisation processes your data and, if so, to receive a copy, together with information about:

• the purpose, meaning why it uses the data;
• the categories of data, such as identity, health, location, purchase history;
• who it has shared the data with or will share it with, including companies outside the European Union;
• how long it keeps the data;
• where it got the data, if not from you;
• whether it uses the data for automated decisions, including profiling, and the logic behind them.

How to write the request

There is no mandatory form. An email or letter to the data protection officer or the company's contact address is enough. Say who you are, what you are asking for and on what basis.

Sample wording. “Under Article 15 of Regulation (EU) 2016/679, please confirm whether you process personal data concerning me and, if so, send me a copy of that data together with the information listed in Article 15(1)(a) to (h). Please reply electronically.”

The organisation may ask you to confirm your identity, but not for more data than it needs to do so. You do not have to explain why you want the information.

Deadlines and costs

• One month from receipt of the request, as a rule.
• Two more months if the request is complex or there are many requests, but the organisation must tell you within the first month and explain the delay.
• Free. The first copy costs nothing. A reasonable fee may be charged for further copies.

The organisation can refuse only if requests are manifestly unfounded or excessive, for example repetitive, and it must prove this.

If you get no answer

You can complain to your data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro, if you received no answer in time or are not satisfied with it. Attach evidence: the request you sent, the date you sent it and any reply. The Romanian authority tells you whether the complaint is admissible within 45 days of registration. You also have the right to go directly to court.

And once you know

The right of access is often the first step. Once you know what data exists, you can ask for wrong data to be corrected, for data processed without a legal basis to be erased, or object to its use for marketing. In each case, the starting point is the same: a simple question, put in writing.

This guide explains the law in force on the date it was checked. It is not a substitute for advice from a specialist on your own situation.