Access: what a complete answer contains

Article 15 requires two things: a copy of the data and a set of statements about it. The second part is regularly overlooked, although it is the more telling one – it explains what happens to the data, while the copy only shows which data exists.

1. The purposes of the processing – separately per purpose, not as a collective term.
2. The categories of data being processed.
3. The recipients. Following a 2023 ruling of the Court of Justice, the actual names have to be given on request, not just categories.
4. The storage period or, where it is not fixed, the criteria used to determine it.
5. Notice of the other rights – rectification, erasure, restriction, objection.
6. The right to complain to a supervisory authority.
7. The source of the data, where it was not collected from the person concerned.
8. Automated decisions including the logic involved and the significance.
9. Transfers to third countries and the safeguards applied.

The limits

The first point on the left needs an addition: where documents also contain third-party data, that does not justify a blanket refusal. The question is whether the other party's details can be removed – only where that is impossible without emptying the content does a restriction come into consideration.

What makes a good response

A response consisting of a raw database dump does not serve the purpose. The Regulation requires a "concise, transparent, intelligible and easily accessible form, using clear and plain language". Column names like usr_flg_3 do not meet that.

A two-part structure has proved itself: first a short text answering the nine points in plain sentences, then the copy of the data as an attachment. That is also the structure that best limits the effort for recurring requests – the first part is largely identical, only the second is individual.

The copy shows which data exists. The nine statements explain why – and only together do they amount to an answer.