Exactly when does the one-month deadline start?

From receipt of the request by the controller, not from the day the responsible person learns of it. The controller provides information on action taken without undue delay and in any event within one month of receipt of the request (General Data Protection Regulation). In practice that means a request sitting unread in a shared mailbox for ten days shortens the remaining handling time by ten days. Recording the receipt date is therefore the first and most important step - and the reason such a request belongs in the same case system as other time-bound tasks.

Do we have to search backups and email mailboxes as well?

The benchmark in the guidelines of the European Data Protection Board is broad: the controller is obliged to search for personal data throughout its IT systems and non-IT filing systems (European Data Protection Board). Mailboxes and paper filing therefore fall within the search space. With backups the situation is practically harder, because the sets are overwritten on a rota and a targeted search is laborious. It makes sense to settle the approach in writing in advance and to document the decision in the case file rather than taking it afresh for each request.

How do we handle emails that also mention other people?

The right to obtain a copy must not adversely affect the rights and freedoms of others (General Data Protection Regulation). The usual route is therefore not to drop the entire thread but to redact the passages concerning other people, together with a short justification in the log. What is affected is mainly names, contact details and statements of third parties. With very long threads it also helps to ask which period or case is meant, a follow-up expressly envisaged where large quantities of data are processed (General Data Protection Regulation).

We hardly ever get requests - is preparation worth it at all?

The rarity is precisely the argument. In the EU-wide action, around 74 per cent of the 1,185 responding controllers reported having received zero to ten access requests in 2023 (European Data Protection Board 2025); the report suspects underreporting. Where something occurs rarely, no routine forms, and the first case hits the company unprepared under a one-month deadline. The same report names the absence of documented internal procedures as a recurring finding, particularly observable in smaller organisations (European Data Protection Board 2025). The effort for a search grid and a response kit falls due once and serves order in the company beyond that.

Handling access requests: deadline, scope, data sources

Q: May we ask for a copy of an identity document?

Only where there are reasonable doubts about identity, and only to the extent necessary. Where the controller has reasonable doubts concerning the identity of the natural person making the request, it may request the provision of additional information necessary to confirm the identity of the data subject (General Data Protection Regulation). If the request comes from a signed-in customer account or from the address recorded in the contract, there is typically no such doubt. Where evidence really is needed, name, address and validity suffice; the remaining fields should be redacted and the copy deleted after the check.

Q: What does access cost and when may we charge a fee?

Access is free of charge as a matter of principle: any communication and any actions taken under Articles 15 to 22 are provided free of charge (General Data Protection Regulation). A fee comes into play for further copies of the same data based on administrative costs, and for manifestly unfounded or excessive requests. The second case has demanding preconditions, since the controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request (General Data Protection Regulation). Anyone taking that route should record the reasoning in writing.

A letter, an email or one sentence on the phone is enough: "I would like to know what data you hold about me." From that moment a one-month deadline runs, and it runs whether or not anybody in the company knows where this person's data actually sits (General Data Protection Regulation). That is the real difficulty. The legal position is manageable and can be read up in a handful of articles. The work sits elsewhere: in the business application, in accounting, in the shared mailbox, in time tracking, in the phone system, in the ticket tool, in the ring binder and in the backups of the past few years. Anyone who starts looking for those places only once the request is on the table is working under time pressure on a task that two quiet afternoons would have settled beforehand. This article therefore does not describe the legal question but the stocktake behind it: which deadline starts when, what the response has to cover, what a search grid across your own systems looks like, and what should remain provable at the end.

Key takeaways

The deadline runs from receipt of the request and is one month. Two further months are possible where complexity and number require it - notified with reasons within the first month (General Data Protection Regulation).
Access is more than a file: it covers confirmation that processing is taking place, eight named items on purposes, categories, recipients, storage period, rights and origin, plus a copy of the data itself (General Data Protection Regulation).
The search does not stop at the business application: under the guidelines of the European Data Protection Board, the controller searches throughout its IT systems and non-IT filing systems (European Data Protection Board).
In the EU-wide action on the right of access, 1,185 of the 13,893 controllers contacted responded; around 74 per cent of the respondents reported receiving zero to ten requests in 2023 (EDPB 2025). The report itself considers underreporting likely.
The recurring finding of that same action is organisational rather than legal: documented internal procedures are missing, and this was particularly observable in smaller organisations (European Data Protection Board 2025).

What an access request sets off

An access request needs no particular form. It needs no template, no subject line, no legal citation in the text and no special courtesy. It can appear as a reply in a running email thread, as a subordinate clause in a complaint, as an attachment to a resignation letter, or as a message through a contact form. The first organisational question is therefore not a legal one but a mailbox one: who reads the incoming channels closely enough that such a sentence is spotted and recorded with a date? In a shared mailbox with no assigned owner, something like this typically sits unread for days because everybody assumes somebody else has already seen it. How to turn a shared mailbox into a case with a receipt date and clear ownership is described in From shared mailbox to a traceable case.

The second point is where the request comes from. Access requests do not only come from customers. They come from former staff, from applicants, from people who made a single enquiry three years ago, from recipients of a newsletter, and occasionally from people the company only encountered through a third party. Requests arising from employment are the case with the widest data spread, because the personnel file, time tracking, access management and the business application all meet there. Which parts make up a digital personnel file and who may see what is covered in Digital personnel files: access and retention.

The third point is what the request actually tests. In practice an access request examines order rather than legal knowledge: anyone who has kept their record of processing activities up to date has already written most of the search grid, because systems, purposes, categories, recipients and periods are set out there. Anyone who did not take it past a first draft starts from scratch when the request arrives. The groundwork is covered in Data protection when digitising processes; this article picks up one level below and asks how the record becomes a searchable list.

What this article is and is not

This is a guide to taking stock inside your own company, not legal advice. Assessing a specific request, weighing the rights of third parties and deciding whether a request may be refused typically belong to a legal review. What is described here is the preparation that makes such a review fast and dependable: knowing which systems hold personal data, what you can search them with, and who answers.

The deadline: one month, and when it starts

The deadline starts when the request is received, not when somebody reads it and not when it is assigned to a responsible person. The controller provides information on action taken without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests, and the data subject must be informed of the extension within one month of receipt, together with the reasons for the delay (General Data Protection Regulation). The extension is therefore not a quiet option: anyone who lets the deadline lapse and only then mentions two extra months has forfeited the condition for that extension.

Event	What to do	When	Reference
The request arrives	Record the receipt date, open a case, calculate the deadline	Day 0	Article 12(3) (General Data Protection Regulation)
Reasonable doubts about identity	Request additional information necessary to confirm identity	as early as possible	Article 12(6) (General Data Protection Regulation)
The request is extensive or many requests are pending	Notify an extension of two months with reasons	within the first month	Article 12(3) (General Data Protection Regulation)
Access is granted	Confirmation, the items under Article 15(1) and the copy handed over	within one month, with an extension within three months	Article 15(1) and (3) (General Data Protection Regulation)
No action is taken	State the reasons and point to the right to lodge a complaint with a supervisory authority and to a judicial remedy	at the latest within one month	Article 12(4) (General Data Protection Regulation)
The request is treated as manifestly unfounded or excessive	Charge a fee or refuse to act; the controller bears the burden of demonstrating this	with the response	Article 12(5) (General Data Protection Regulation)
Further copies are requested	A reasonable fee based on administrative costs is possible	with the further copy	Article 15(3) (General Data Protection Regulation)

The first response is free of charge. Information under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 are provided free of charge (General Data Protection Regulation). A fee comes into play in only two narrowly framed situations: for further copies of the same data, based on administrative costs, and for manifestly unfounded or excessive requests. The second case is harder than it sounds, because the controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request (General Data Protection Regulation). Anyone choosing that classification therefore needs a documented justification, not a feeling about the effort involved.

For deadline tracking in daily practice this means: the case needs a receipt date, a calculated response date and a reminder well before it, typically at the halfway point. What works in practice is to run the case where the other time-bound tasks already sit, rather than in a separate mailbox. How to attach responsibilities and deadlines to accounts and roles instead of to individuals is described in Accounts and access: automating joiners and leavers - the same mechanism carries here, because an access case needs a deputy as soon as the responsible person is on leave.

The scope: what access actually covers

Scope is the point where most responses fall short. The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and to a set of further information (General Data Protection Regulation). Access therefore consists of three parts that have to be delivered separately: the confirmation, the eight named items and the copy of the data itself. A response that merely attaches a data export leaves out two thirds.

The eight items are listed in the regulation and can largely be drafted once, because they do not depend on the individual request but on what the company processes. That is precisely where the leverage sits: write them out cleanly once per processing activity and you have answered the recurring part of every future request in advance. What remains is the individual part, namely the search for this one person's data.

The purposes of the processing - what this person's data is used for in the company, broken down by processing activity rather than as an umbrella term.
The categories of personal data concerned - master data, contract data, payment data, communication data, log data.
The recipients or categories of recipient to whom the data have been or will be disclosed, including recipients in third countries or international organisations.
Where possible, the envisaged storage period or, where that is not possible, the criteria used to determine that period.
The existence of the right to rectification, erasure, restriction of processing and objection.
The existence of the right to lodge a complaint with a supervisory authority.
Where the data were not collected from the data subject: any available information as to their source.
The existence of automated decision-making including profiling and, in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences.

On top of that comes the copy: the controller provides a copy of the personal data undergoing processing, and for any further copies may charge a reasonable fee based on administrative costs (General Data Protection Regulation). The copy is not a raw database dump but an intelligible rendering of what is stored about the person. Where a storage period has to be stated, a maintained deletion concept helps more than any wording: the periods are then already fixed and do not have to be derived afresh for each request. How to reflect such periods technically is set out in Meeting retention periods digitally.

Where the data actually sits

This is where preparation parts company with improvisation. The guidelines of the European Data Protection Board on the right of access state the benchmark plainly: data subjects should have access to all the information that the controller processes regarding them, which means, for example, that the controller is obliged to search for personal data throughout its IT systems and non-IT filing systems (European Data Protection Board). The words "non-IT" are the part that gets overlooked in practice: the ring binder on the shelf, the signature folder and the printed case file all belong in scope as soon as they are kept in a filing system.

The practical route there is a list drawn up before the first request arrives: one line per system with the name of the system, the search terms that will find a person in it, the responsible role and a realistic response time. That list is the actual work, and it is reusable. It also answers a second question that often stays open in daily practice: which systems exist at all, and who looks after them? Anyone who has drawn a process map will find the starting point there - see A process map for mid-size companies.

Two data holdings regularly fall through the grid. The first is backups: data in backups is processed data too, but searching it is laborious and the sets are overwritten on a rota. It makes sense to settle the approach in advance and note it in the case file rather than deciding it afresh for every request. What an orderly backup holding looks like, one where a given state can actually be retrieved on purpose, is described in Backups that hold up in an emergency. The second holding is processors: data sitting in a commissioned system remains the controller's data, and access has to cover it. The contract should therefore name a duty to assist and a response time.

search-grid.txt

Search grid for access requests - one line per system

System                Search terms                          Role          Answer in
--------------------  ------------------------------------  ------------  ------------
Business application  name, customer number, email          Sales         1 day
Accounting            name, debtor/creditor number          Accounting    1 day
Shared mailbox        email address, name, case number      Case handling 2 days
Personal mailboxes    email address, name                   per person    5 days
Time tracking         staff number, name                    HR            1 day
Phone system          phone number                          IT            2 days
Ticket system         email address, ticket number          IT            1 day
Paper filing          name, contract number                 Front office  3 days
Processors            identifier in the given system        Purchasing    per contract
Backups               only on a justified request           IT            by arrangement

Rule: not in the grid = not searched.
Every new application gets a line before it goes live.

The grid has a side effect that reaches beyond data protection: it shows in how many places the same person is held and how differently they are named there. Anyone who finds the same person as a customer number, as a debtor, as an email address and as an abbreviation in the ticket system does not have a data protection problem but a master data problem with a data protection symptom. This is exactly where sound data integration comes in: one leading system and defined references turn the search into a query instead of a tour through eight user interfaces.

Checking identity without hoarding data

Identity checking is the point where two mistakes sit close together. One is answering without any check and thereby handing personal data to an unauthorised person. The other is demanding so much that the check itself becomes an obstacle. The rule is short: where the controller has reasonable doubts concerning the identity of the natural person making the request, the controller may request the provision of additional information necessary to confirm the identity of the data subject (General Data Protection Regulation). Two words carry that sentence - "reasonable" doubts and "necessary". Demanding a copy of an identity document from everybody as a matter of routine typically satisfies neither.

What works in practice is a graded approach. If the request comes through a channel already tied to the person - the registered customer account, the known email address from the running contract, the postal route to the contract address - the doubt is usually slight. If it comes from an unknown address and concerns a sensitive data situation, a query through a second, already known channel is typically the milder means compared with a copy of an identity document. Where a document really is needed, the fields that are not needed should be redacted, and the copy deleted after the check. On the question of when a signature needs which form and when simple electronic evidence suffices, see Electronic signatures: which form is legally valid.

Known channel

The request comes from the signed-in customer account or from the address recorded in the contract. The doubt is slight and an additional check is typically dispensable.

Return channel instead of ID

With an unknown sender address, a reply to the known address or a call back on the recorded number reaches the goal faster than a copy of an identity document - and creates no new data.

ID with redaction

Where official evidence is needed, name, address and validity are enough. Document number, access number and photograph are redacted, and the copy is deleted after the check.

Representation with authority

Where a representative makes the request, the authority is checked and its scope recorded. The response goes to the data subject or to the address named in the authority.

Employees

With requests arising from employment, identity is usually known. The check shifts to the question of which systems hold personal data and who may release it.

Record the outcome

Which route was chosen and why belongs in the case file. That is the place where you can later show that a check happened before data left the building.

One special case deserves attention: where a controller processes data for purposes that do not or no longer require it to identify the data subject, and it demonstrates that it is not in a position to identify that person, it informs the person accordingly where possible; Articles 15 to 20 then do not apply unless the data subject provides additional information enabling their identification (General Data Protection Regulation). That is not an excuse for poorly maintained data but a rule for holdings deliberately kept without a personal reference. Where the match fails instead because of duplicates and inconsistent spellings, the fault lies in the master data - on which see Getting master data in order.

The response: form, format, proof

A good response is structured and readable for a person who knows neither your systems nor your filing structure. A fixed package works well: a cover letter naming the request with its date and explaining the structure; a section with the eight items under Article 15(1), completed per processing activity; the copy of the data, separated by source system; and a note on what is not included and why. The last point is often left out and is the most valuable, because it heads off follow-up questions.

On format the rule is: where the request was made electronically, the information is provided in a commonly used electronic form unless the person asks otherwise. In practice that means a document that opens without special software, supplemented by tables where lists arise. A database dump in an in-house format typically does not serve the purpose, because it is not intelligible. The delivery route needs a decision too: a package with personnel data does not belong unencrypted in an email, and the recipient address should be the one through which identity was confirmed.

response-package.txt

Response package - fixed structure for every access request

01_cover_letter.pdf       request of DD/MM/YYYY, receipt, structure of the package
02_article15_items.pdf    purposes, categories, recipients, period, rights,
                          source, automated decisions
03_copy_master_data.pdf   name, address, contact, accounts, consents
04_copy_records.pdf       contracts, invoices, payments, reminders
05_copy_threads.pdf       email threads, tickets, call notes
06_export.csv             lists from time tracking, logs, attachments
07_log.pdf                systems searched, search terms, date, omissions

Delivery: encrypted, to the confirmed address
Log:      receipt, check, delivery with dates in the case file
Storage:  copy of the package for the retention period, then deletion

The last file in the package is the most important one for the company itself. It records which systems were searched, with which terms, as at which date, and what was deliberately left out. Without that record you can neither answer a follow-up question six months later nor rebut a complaint. The same logic carries process documentation for tax purposes, and the building blocks overlap heavily - see Writing process documentation for audits.

Limits: third-party rights and excessive requests

The right to a copy has an express limit: the right to obtain a copy must not adversely affect the rights and freedoms of others (General Data Protection Regulation). In practice this mainly concerns communication. An email thread contains names and statements of colleagues and third parties; a call note names participants; a complaint contains another person's account. The answer is not to omit the holding but to work on it: third-party data is redacted, the rest is released, and the redaction is justified. Blanket omission of whole holdings with a reference to third-party rights typically does not survive scrutiny.

For very large data holdings there is a second option that is often overlooked. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that the data subject specify the information or processing activities to which the request relates before the information is delivered (General Data Protection Regulation). That is a follow-up question, not a refusal: it does not replace access if the person insists on the full scope. Under the guidelines of the European Data Protection Board, the time limit may be suspended until the specification arrives, provided the follow-up was asked without undue delay and the conditions of Recital 63 are met (European Data Protection Board). Put as a polite, concrete question about the period or case concerned, it saves both sides work.

The fine range attaches to the right of access

Infringements of the data subject's rights under Articles 12 to 22 fall into the higher tier: administrative fines up to 20 000 000 EUR, or in the case of an undertaking up to 4 per cent of the total worldwide annual turnover of the preceding financial year, whichever is higher (General Data Protection Regulation). That is the range, not the expectation; the actual amount depends on the nature, gravity and duration of the infringement and further criteria. What matters is the classification: an unanswered access request is not a second-order formality.

The workflow in daily practice

The EU-wide coordinated action on the right of access provides a useful outside view. Throughout 2024, 30 supervisory authorities across the European Economic Area launched coordinated investigations, and 1,185 of the 13,893 controllers contacted responded to the questionnaire (European Data Protection Board 2025). Around 74 per cent of responding controllers reported having received zero to ten access requests in 2023, though the report itself notes that the number actually received was likely underreported (European Data Protection Board 2025). Taken together, the two figures describe the situation in mid-size companies rather precisely: access requests are rare enough that no routine forms, and frequent enough that every company meets one eventually.

Step 1

Step 1: name the intake channels

Write down the routes through which a request can arrive: mailboxes, contact form, telephone, post, customer account, branch counter. For each channel, settle who reads it and how a request is recognised as such and recorded with a date. Without this step the deadline starts on a date that cannot be evidenced later.

Where the search fails for lack of order, the exercise helps twice over: it shows which holdings can be searched at all. A folder of scanned records without text recognition is useless for a person search, while a searchable holding with indexing returns a result in minutes. The route from folder to searchable holding is set out in Getting started with document management.

The list is the work, not the letter

The response letter is written in two hours once it is clear where to search. If that is not clear, the same case takes several days and still ends up incomplete because two systems were forgotten. The difference between the two is a list drawn up before the first request - and one that puts the rest of the company in order anyway, because it writes down for the first time where which data sits and who looks after it.

What should remain provable

The receipt date of the request, recorded on the day it arrives rather than estimated after the fact - it is the starting point of the one-month deadline.
The identity check: which route was chosen, why, and with what result. Where a request is refused for lack of identifiability, the reasoning belongs with it.
The systems searched with the search terms used and the date of the search. This record is what shows that the search went beyond the obvious systems.
Redactions with reasons: which passage, whose right, which balancing. Without a reason, a redaction can no longer be explained later.
Delivery route and recipient address, with the date. For encrypted delivery, also how the password was transmitted.
Any extension of the deadline with its reason and the date of notification - the notification itself has to have gone out within the first month and is worthless later without evidence.

These six points double as the structure of the log in the response package. They are deliberately kept lean, because a log that demands more tends to stay blank in practice. Adopt this structure once into your own filing and put it where the other evidence sits, and the case is closed - which fits the cut of process documentation, because the same items are required there anyway.

An access request does not measure a company's legal knowledge but its order. The deadline is the same for everyone; what differs is whether somebody can say where to search.

Prozessoptimierung IT

Sources and studies

This article draws on: Regulation (EU) 2016/679 (General Data Protection Regulation), Article 11(2) (processing not requiring identification), Article 12(3) to (6) (deadline, failure to act, no charge and burden of proof, doubts about identity), Article 15(1), (3) and (4) (scope of access, copy, rights of others), Article 83(5) (fine range) and Recital 63 (specification with large quantities of data); European Data Protection Board, Guidelines 01/2022 on data subject rights - Right of access, Version 2.1, adopted on 28 March 2023, paragraphs 125 (searching IT systems and non-IT filing systems) and 159 (possible suspension of the time limit where a specification is requested); European Data Protection Board, 2024 Coordinated Enforcement Action - Implementation of the right of access by controllers, 16 January 2025 (30 participating supervisory authorities, 1,185 responding controllers out of 13,893 contacted, share receiving zero to ten requests in 2023, finding on missing documented procedures). The stocktake of your own systems on which the search grid builds comes out of a process analysis.