Access is a copy plus eight things
A subject access request obliges you to provide a copy of the personal data and, with it, the purposes, the categories of data, the recipients, the retention period, the existence of the other rights, the source if not collected from them, and whether there is automated decision-making.
Why it is like this
A pile of data without context cannot be checked for accuracy or challenged. The extra information is what makes the other rights usable.
Not to be confused with
A data dump. Nor is it a right to the documents themselves: it covers personal data relating to the requester, and the copy must not adversely affect others' rights — which means redaction, not refusal.
In practice
Exporting a CSV of a user's rows satisfies the copy and none of the other eight items. Most access responses that go wrong go wrong there.
Source: Regulation (EU) 2016/679 (GDPR) — Article 15. Read on .
Say it back Check yourself
Beyond the copy of the data, name four things an access response must also tell the data subject.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- The purposes of the processing
- The categories of personal data concerned
- The recipients or categories of recipient
- The envisaged retention period, or the criteria for it
- The existence of the rights to rectification, erasure, restriction and objection
- The right to lodge a complaint with a supervisory authority
- The source of the data where not collected from the data subject
- The existence of automated decision-making, with meaningful information about the logic
Any four of the eight. The one people forget most often is the source — it is the item that exposes data brokerage.