Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Source : EU law

Code/RS : 2016/679

Abbreviation :
GDPR
Provision :
Art. 15
Short description :
Data subject's right of access to his/her personal data
Nature of the provision :
Right to request data
Status :
In force
Sector :
All

Legal text :

Right of access by the data subject

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4).

2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

Actor with an obligation to share data

Organisation holding personal data (‘controller’) = the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data

Beneficiaries

Person whose personal data is processed (‘data subject’) = identified or identifiable natural person whose personal data is processed

Linking criteria for Switzerland

Linking criteria for Switzerland

Financial aspects

In principle free (exceptions may apply)

Binding and/or enforceable

Binding obligation; enforceable right

Conditions for accessing data

Existence of personal data concerning the applicant processed by the controller

Exceptions and limitations

Preservation of the rights and freedoms of others (see Art. 15(4) GDPR)

Static data

Format

No required format Note: Where the data subject submits his/her request in electronic form, the information must be provided electronically where possible, unless the data subject requests otherwise.

Plateform

n/a

Actor with an obligation to share data Organisation holding personal data (‘controller’) = the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data

Beneficiaries Person whose personal data is processed (‘data subject’) = identified or identifiable natural person whose personal data is processed

Linking criteria for Switzerland See Art. 3 GDPR: the GDPR may apply to Swiss companies (i) which have an establishment in the EU; (ii) which offer goods and services to the EU; or (iii) which monitor the behaviour of persons in the EU.

Financial aspects In principle free (exceptions may apply)

Binding and/or enforceable Binding obligation; enforceable right

Conditions for accessing data Existence of personal data concerning the applicant processed by the controller

Exceptions and limitations Preservation of the rights and freedoms of others (see Art. 15(4) GDPR)

Time component Static data

Format No required format Note: Where the data subject submits his/her request in electronic form, the information must be provided electronically where possible, unless the data subject requests otherwise.

Plateform n/a

Compilation and Disclaimer

This index was prepared on behalf of the IPI by the law firm id est avocats Sàrl (for the section on Swiss law) and the law firm Pierstone (for the section on European law).

This index does not constitute legal advice, and no guarantee is given regarding its completeness.

Neither id est avocats Sàrl, nor Pierstone, nor the IPI or the FDJP can be held liable for any decisions or actions taken on the basis of this index.