The right of access is a person's legal entitlement to ask an organisation whether it processes their personal data and, if it does, to receive a copy of that data together with an explanation of what is being done with it. In the European Union it sits in Article 15 of the General Data Protection Regulation (GDPR). It exists because every other privacy right depends on it. Nobody can correct, delete or object to data they cannot see, and nobody can complain to a regulator about processing they do not know is happening. A request made under it is usually called a data subject access request (DSAR), or simply a subject access request. In advertising, it is the main window into systems otherwise invisible to the people they profile.

What a controller must hand over

Article 15 has three layers. The first is confirmation: a yes or no answer on whether personal data is being processed. The second is the data itself. Article 15(3) requires the controller, the company that decides why and how data is processed, to provide "a copy of the personal data undergoing processing". The third is context. Article 15(1)(a) to (h) lists eight items: the purposes of processing; the categories of data; the recipients or categories of recipients, particularly in third countries; the retention period or the criteria used to set it; the existence of the rights to rectification, erasure, restriction and objection; the right to complain to a supervisory authority; the source of data not collected from the person; and the existence of automated decision-making, including profiling, with "meaningful information about the logic involved".

The procedure sits in Article 12. A controller must respond within one month of receipt, extendable by two further months for complex or numerous requests, provided the requester is told about the delay within the first month. The first copy is free. A "reasonable fee based on administrative costs" may be charged for further copies. Under Article 12(5), a controller may refuse or charge for requests that are "manifestly unfounded or excessive", but it carries the burden of demonstrating that. Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others, which is the basis for redacting third-party data and, in some cases, trade secrets.

In ad tech, scope goes beyond names and email addresses. Cookie IDs, mobile advertising IDs, IP addresses, inferred segments and conversion events are personal data when they relate to an identifiable person. Regulators have repeatedly found that self-service download tools do not cover everything Article 15 requires.

Origin and evolution

The idea predates the GDPR by decades. The Council of Europe's Convention 108, opened for signature on January 28, 1981, gave individuals the right to obtain confirmation of whether data about them was stored and to receive it "in intelligible form". Directive 95/46/EC, adopted on October 24, 1995, turned that into Article 12, an EU-wide right of access. Article 8(2) of the EU Charter of Fundamental Rights, binding since December 1, 2009, made access part of a fundamental right.

Max Schrems, then an Austrian law student, showed in 2011 what an access request could expose when Facebook's response ran to 1,222 pages, according to his group europe-v-facebook.

The GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, expanded the right with the copy requirement, the profiling disclosures and shorter deadlines. The Court of Justice of the European Union (CJEU) then filled in the details. In Oesterreichische Post (C-154/21, January 12, 2023), it held that people may demand the identity of specific recipients, not merely categories, unless that is impossible or the request is excessive. In F.F. (C-487/21, May 4, 2023), it ruled that a "copy" means a faithful and intelligible reproduction of the data, which can require extracts of documents or entire documents. In FT v DW (C-307/22, October 26, 2023), it held that the first copy is free even when the requester wants it for a dispute unrelated to data protection, and that no reason has to be given. Dun & Bradstreet Austria (C-203/22, February 27, 2025) required explanations of automated decisions that a person can understand and contest.

The European Data Protection Board (EDPB) put its interpretation into Guidelines 01/2022, opened for consultation in January 2022 and adopted in final form on March 28, 2023.

Equivalents outside the EU

The United Kingdom kept the right in the UK GDPR after Brexit. The Data (Use and Access) Act 2025, which received Royal Assent on June 19, 2025, added a "stop the clock" rule from February 5, 2026: the response period pauses while a controller waits for a requester to clarify the scope of a request.

In California, the equivalent is the right to know. The California Consumer Privacy Act (CCPA), signed on June 28, 2018 and effective January 1, 2020, lets consumers ask a business for the categories and specific pieces of personal information it has collected, the sources, the business purposes, and the categories of third parties that receive it. Businesses must respond to a verifiable request within 45 days, with one 45-day extension where reasonably necessary. Regulations approved on September 23, 2025 and effective January 1, 2026 require businesses that keep data longer than 12 months to let consumers request information collected as far back as January 1, 2022, according to a DLA Piper summary.

Why it matters for marketers

Access requests have become an enforcement tool in their own right, and much of the evidence about ad tech data flows has come from them. A TikTok user who asked for his data in September 2024 received a file showing off-platform activity, including Grindr app usage, allegedly passed through the attribution company AppsFlyer. noyb, the Vienna privacy group, filed two complaints in Austria on December 9, 2025.

The same pattern recurs. WetterOnline, a German weather app, refused a full copy citing disproportionate effort, while its privacy policy listed more than 800 advertising partners. Austria's data protection authority ruled on August 7, 2025 that YouTube had violated Articles 12 and 15 by answering a 2018 request with Takeout files in JSON format and no detail on advertising profiles, recipients or sources. On November 26, 2025, the Austrian Supreme Court ordered Meta to give Schrems all personal data with source, recipients and purpose for each item, rejecting its download tool as an answer.

Every party in a data chain can be asked to account for what it holds, and a joint controller cannot simply redirect requests to its partner.

Limitations and disputes

The right is strong on paper and uneven in practice. The EDPB's 2024 coordinated enforcement action, which covered 1,185 controllers and produced a report adopted on January 20, 2025, found searches that were too narrow, generic answers naming categories of recipients rather than actual recipients, routine identity checks used as barriers, and overuse of the "excessive" exemption.

Delays are a second weakness. The YouTube case took about five years and seven months, partly because Ireland's Data Protection Commission, lead authority under the one-stop-shop, held the file until November 2022.

Controllers complain of the opposite problem: requests used to manufacture damages claims. In Brillen Rottler (C-526/24), decided on March 19, 2026, the CJEU accepted that even a first request can be refused as excessive where it is made with the abusive intention of creating grounds for compensation. The controller must prove that intention, and factors include the gap between handing over data and making the request and a pattern of similar claims.

Scope is contested too. noyb argues in a May 5, 2026 complaint that LinkedIn must disclose who viewed a member's profile, information it sells to Premium subscribers, while LinkedIn relies on the third-party rights exception in Article 15(4). noyb also says SCHUFA, the German credit bureau, leaves archived historical data out of its answers, affecting about 1.6 million requesters a year by noyb's estimate.

Not the same as

Data portability. Article 20 gives a right to receive data a person provided, in a structured, machine-readable format, and to have it moved to another controller. Access covers all personal data, including inferred data, and includes the explanatory information in Article 15(1).

Access to file. In EU competition law, access to file is the right of a company charged by the European Commission to inspect the evidence in the case file. It protects the rights of defence, not personal data.

Right of access to a device. Article 5(3) of the ePrivacy Directive governs storing or accessing information on a user's terminal equipment, the basis of cookie consent. It restricts companies' access to devices rather than granting individuals access to data.

Recent developments

The right is now a target of legislative change. The Commission's Digital Omnibus, proposed on November 19, 2025, would let controllers refuse or charge for requests made for purposes other than the protection of data, with only "reasonable grounds" needed to treat a request as excessive. On February 10, 2026, the EDPB and the European Data Protection Supervisor asked legislators not to link abuse to the requester's purpose. Council document 13886/26 of October 2, 2026 kept a version of the abuse clause. As of October 13, 2026, the Digital Omnibus had not reached trilogue.

The courts continue to define the edges. On April 16, 2026, Advocate General Rimvydas Norkus advised in Lindenberg (C-205/25) that data protection authorities must themselves honour access requests from complainants; no judgment had been found as of October 13, 2026. In April 2026, a recruiter's request to Zalando revealed a hiring panel's unanimous yes overruled by a director's note.

Timeline

  • January 28, 1981 - Convention 108 opens for signature, with a right to confirmation and communication of stored data
  • October 24, 1995 - Directive 95/46/EC adopted; Article 12 creates an EU-wide right of access
  • December 1, 2009 - The Charter of Fundamental Rights, including Article 8(2), becomes binding
  • 2011 - Max Schrems receives a 1,222-page response from Facebook
  • April 27, 2016 - GDPR adopted
  • May 25, 2018 - GDPR applies, with Article 15
  • June 28, 2018 - CCPA signed in California
  • January 1, 2020 - CCPA takes effect, including the right to know
  • January 12, 2023 - CJEU rules in C-154/21 on identifying specific recipients
  • March 28, 2023 - EDPB adopts final Guidelines 01/2022 on the right of access
  • May 4, 2023 - CJEU defines "copy" in C-487/21
  • October 26, 2023 - CJEU rules in C-307/22 that requesters need not give reasons
  • January 20, 2025 - EDPB adopts its coordinated enforcement report on access, covering 1,185 controllers
  • February 27, 2025 - CJEU rules on explaining automated decisions in C-203/22
  • June 19, 2025 - UK Data (Use and Access) Act 2025 receives Royal Assent
  • August 7, 2025 - Austrian authority finds YouTube violated Articles 12 and 15
  • November 19, 2025 - Commission proposes the Digital Omnibus, including limits on abusive requests
  • November 26, 2025 - Austrian Supreme Court orders Meta to provide full access to Max Schrems
  • January 1, 2026 - California regulations extend right-to-know lookback to January 1, 2022
  • February 5, 2026 - UK "stop the clock" rule for access requests takes effect
  • February 10, 2026 - EDPB-EDPS joint opinion opposes purpose-based abuse test
  • March 19, 2026 - CJEU rules in Brillen Rottler (C-526/24) that a first request can be abusive
  • April 16, 2026 - Advocate General opinion in C-205/25 on access to regulators' files
  • May 5, 2026 - noyb complaint over LinkedIn profile visitor data
  • October 2, 2026 - Council document 13886/26 retains an abuse clause in Article 12(5)

Summary

Who: Any individual whose personal data is processed (the data subject) exercises the right; controllers, from platforms and ad tech vendors to apps and credit bureaus, must answer; national data protection authorities and courts enforce it, with groups such as noyb bringing many of the cases.

What: The right to confirmation that personal data is processed, a copy of that data, and information on purposes, recipients, retention, sources and automated decision-making, under GDPR Article 15, with comparable rights such as the CCPA right to know in California.

When: Rooted in Convention 108 of 1981 and the 1995 Data Protection Directive, applicable in its current form since May 25, 2018, and shaped by CJEU rulings from 2023 to 2026; the Digital Omnibus may narrow it.

Where: Across the EU and European Economic Area, in the UK under the UK GDPR, in California and other US states under their own statutes.

Why: Because people cannot correct, delete or contest data they cannot see, access is the gateway to every other privacy right and, in advertising, a main source of evidence about how profiles are built and shared.