Right of access

The right of access is the right of the data subject to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data together with information on the purposes, the categories of data, the recipients, the retention period, the other rights, the source of the data, the existence of automated decision-making and, for transfers, the safeguards applied (Art. 15(1) and (2) GDPR). The controller must provide a copy of the data free of charge, in a commonly used electronic form if the request is made electronically (Art. 15(3)).

The response deadline is one month, extendable by two further months for complex or numerous requests (Art. 12(3)). Requests can be made in any form and need not cite the GDPR; identity may be verified proportionately. The EDPB Guidelines 01/2022 stress that the right covers all data, including inferences and internal notes, and that the copy must be intelligible. The Court of Justice has held that individuals are entitled to the identity of specific recipients (C-154/21) and to a faithful copy of documents where context is needed (C-487/21). The rights of others, including trade secrets, may limit but not negate the right (Art. 15(4)).

In clinical research, access requests are usually addressed to the investigator site, which holds the identifying data and medical records, while the sponsor holds only pseudonymised data that it cannot link to the requester without the site. Art. 11 allows a controller that cannot identify the data subject to say so, but the sponsor and site should have an agreed procedure so that the participant receives a complete answer. Where Member State law implements the Art. 89(2) research derogation, access may be limited if it would seriously impair the research, but this must be documented and is not automatic. Site staff also have access rights over the data sponsors hold about them.