Data Subject Access Requests: How to Respond Within One Month

What the person is entitled to

Under Article 15 GDPR, the person has the right to confirmation of whether you process their data, access to the data, and the following information:

the purposes of the processing and the categories of personal data;
the recipients or categories of recipients, in particular outside the EEA, and the safeguards for any transfers (Article 15(2));
the retention period, or the criteria used to set it;
their rights to rectification, erasure, restriction and objection, and to complain to a supervisory authority;
the source of the data, if you did not collect it from them;
any automated decision-making, including profiling, with meaningful information about the logic and consequences.

You must provide a copy of the personal data being processed; further copies may carry a reasonable fee based on administrative costs (Article 15(3)). The Court of Justice has held that the copy must be a faithful and intelligible reproduction of the data, which can mean providing extracts of documents or database entries where that is needed to make the data understandable (C-487/21, 4 May 2023).

The deadline

Situation	Rule	Article
Standard	Without undue delay and at the latest within one month of receipt	12(3)
Complex or numerous requests	Extension by two further months, if you tell the person within the first month, with reasons	12(3)
You will not act	Tell the person within one month why, and that they can complain and seek a judicial remedy	12(4)

The clock starts on receipt. The EDPB expects requests sent to your official contact points, such as customer service, to be routed internally and answered within the deadline, so make sure those channels know where to forward them.

Step by step

1. Recognise the request

GDPR sets no formal requirements for an access request: it can come by email, letter, chat or phone, without using the words "subject access request" or "Article 15". The person does not have to give reasons. Log the date of receipt.

2. Confirm identity, proportionately

You may ask for additional information where you have reasonable doubts about the requester's identity (Article 12(6)). The EDPB considers it disproportionate to require a copy of an identity document when the person is already authenticated, for example logged into their account, and treats ID copies as generally inappropriate unless necessary and in line with national law. Ask only for what you need to be sure.

3. Find all the data

Search every system on your records of processing: CRM, email, support tickets, billing, logs, backups where data is retrievable, and processors that hold data for you. Your record of processing activities is the map.

4. Protect others

The right to a copy must not adversely affect the rights and freedoms of others (Article 15(4)). Redact other people's personal data and trade secrets where necessary, but do not use this as a reason to refuse everything.

5. Respond

Send the confirmation, the copy and the Article 15(1) information in a concise, intelligible form. If the request came electronically, answer electronically in a commonly used format unless the person asks otherwise (Articles 12(3) and 15(3)). The first copy is free.

When you can refuse or charge

Only where a request is manifestly unfounded or excessive, in particular because it is repetitive, may you charge a reasonable fee or refuse (Article 12(5)), and you bear the burden of proving it. The EDPB is clear that you should not assess why the person asks, and should not refuse because you suspect the data will be used against you, for example in a dismissal or commercial dispute.

Build it into your routine: a request template, a search checklist per system and a log of requests with dates make the one-month deadline easy. The free GDPR Compliance Checklist covers data subject rights.

Know where the data is before the request arrives. The GDPR Records of Processing (RoPA) Kit includes controller and processor RoPA templates and a data inventory workbook, the map you search when a request comes in.