1A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. 2This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. 3Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. 4Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. 5That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. 6However, the result of those considerations should not be a refusal to provide all information to the data subject. 7Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.
Title is an unofficial description, added for readability.
See the data, check the processing
Access comes first. GDPR Recital 63 says people should be able to see the personal data collected about them, easily and at reasonable intervals, so they can check the processing is lawful. That includes health records. They should learn the purposes, the storage period where possible, the recipients, and the logic of automated processing. Other people’s rights, including trade secrets, can limit what is shared, but never to the point of refusing everything.
What the right of access covers
Article 15 is the binding rule behind this recital. It gives the data subject a right to confirmation of whether their data are processed, to the data themselves, and to information including the purposes, the categories of data, the recipients, the envisaged storage period (or the criteria for it), the source where the data were not collected from them, and, for automated decision-making under Article 22, meaningful information about the logic involved (Art. 15(1)). The controller must provide a copy of the data, and may charge a reasonable fee based on administrative costs for further copies (Art. 15(3)), and the right to a copy must not adversely affect the rights and freedoms of others (Art. 15(4)).
Article 12 sets the ground rules for handling the request: the controller must facilitate the exercise of the right (Art. 12(2)), answer within one month, extendable by two further months where necessary given the complexity and number of requests (Art. 12(3)), and act free of charge unless a request is manifestly unfounded or excessive, which the controller must demonstrate (Art. 12(5)). Recital 63 adds the why: access exists so that people can be aware of the processing and verify that it is lawful.
The recital explains the right, it doesn’t narrow it
The CJEU held that the purpose in Recital 63’s first sentence cannot be used to reject a request made for another reason, because a recital has no binding legal force and the Articles don’t require people to give reasons. A patient seeking evidence for a liability claim still gets a free first copy, as the FT v DW case shows.
Recital 63 sentence by sentence
| Recital 63 says | Binding provision | Case law |
|---|---|---|
| (1) Access should be easy, at reasonable intervals, to be aware of and verify lawfulness | Art. 15(1); Art. 12(2) and (5) | CJEU C-307/22: no reason needed; AP, Uber: request form must be easy to reach |
| (2) This includes health data such as medical records | Art. 15(1) and (3) | CJEU C-307/22: full copies of record documents where essential |
| (3) People should learn purposes, storage period where possible, recipients, the logic of automated processing and its consequences | Art. 15(1)(a), (c), (d) and (h) | CJEU C-203/22: explain the procedure and principles actually applied |
| (4) Where possible, remote access to a secure system | No Article requires remote access; Art. 15(3) requires a commonly used electronic form for electronic requests, unless the person asks otherwise | – |
| (5)–(6) Others’ rights, including trade secrets, count, but must not lead to refusing all information | Art. 15(4); Art. 23(1)(i) | CJEU C-203/22: disputed information goes to the authority or court for balancing |
| (7) With large amounts of data, the controller may ask the person to specify | No matching wording in Art. 15 | – |
Numbers in brackets refer to the sentences of Recital 63 as numbered above.
What this means in practice
Yes
Wherever possible, choose a way of sharing that does not infringe their rights, and don’t refuse everything. Information you consider protected must be provided to the supervisory authority or court, which decides how much the person gets (C-203/22)
No
Provide the full copy
If requests come through an app or portal
Recital 63 says access should be easy and, where possible, remote through a secure system.
- Put the request route where people look for it. The Dutch AP found Uber’s form, several menus deep under “Help” and “Legal concerns”, too hard to reach (AP decision, section 4.2).
- Deliver files people can actually read. A raw CSV with no instructions for displaying it was not “easily accessible”.
- Provide explanations in the language of the people you serve, not only in English.
If you use automated scoring or profiling
People can ask for the logic behind automated decisions about them.
- Explain the procedure and principles actually applied to their data. Neither a bare formula nor a full description of every step is enough.
- One option the CJEU mentioned: explain how a change in the person’s data would have changed the result.
- A trade secret is not a blanket exemption. Information you consider protected must be provided to the supervisory authority or court, which balances the interests.
Enforcement cases
Two new case studies cover the scope of the free first copy and how far trade secrets can limit access. Two decisions already published on this site also involve access requests: the Uber fine (published under Article 13) and ACVIL Aparcamientos (published under Recital 67).
| Case | Authority / court | Date | Outcome | Recital 63 issue |
|---|---|---|---|---|
| Uber (Netherlands) | AP | Dec 2023 | €10.000.000; objection declared unfounded, Uber appealing to the court | Access form hard to reach; copies not easily accessible (published under Article 13) |
| FT v DW (C-307/22) | CJEU | Oct 2023 | Preliminary ruling; no fine | Free first copy of medical records, whatever the reason |
| Dun & Bradstreet Austria (C-203/22) | CJEU | Feb 2025 | Preliminary ruling; no fine | Logic of automated decisions and trade secrets |
| ACVIL Aparcamientos (Spain) | AEPD | Mar 2026 | €90.000 paid, incl. €75.000 proposed under Art. 15 before reductions | Late reply, with a condition the law doesn’t require (published under Recital 67) |
All Recital 63 enforcement cases
Frequently asked questions
Do I have to say why I want access to my data?
No. The CJEU held in C-307/22 that the GDPR does not let a controller demand reasons for an access request, and that the purpose in the first sentence of Recital 63 cannot be used to refuse a request made for another reason, such as a medical liability claim.
Is a copy of my data free?
The first copy is. Under Article 15(3), a reasonable fee based on administrative costs may be charged for further copies. Separately, under Article 12(5), a controller may charge a reasonable fee or refuse to act only if a request is manifestly unfounded or excessive, and it bears the burden of demonstrating that.
Can a company refuse access because of trade secrets?
Not outright. Recital 63 says the rights of others, including trade secrets, should not lead to refusing all information. In C-203/22 the CJEU held that allegedly protected information must be given to the supervisory authority or court, which balances the interests case by case.
Does the right of access cover my full medical records?
It covers the health data in them. The CJEU held in C-307/22 that a patient is entitled to a faithful and intelligible copy of all their data, including full copies of documents in the records where that is essential to check the data are accurate, complete and understandable.
Can a controller ask me to narrow down my request?
Recital 63 says that where a controller processes a large quantity of information about a person, it should be able to ask, before delivering the information, which information or processing activities the request relates to.
Could your team answer every access request within a month?
Article 12(3) sets a one-month deadline. Tracking each request, its deadline and what was sent makes it easier to show the request was handled properly.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 63, Articles 12, 15 and 23: official text
- Autoriteit Persoonsgegevens, decision imposing a fine on Uber B.V. and Uber Technologies Inc., 11 December 2023 (Dutch)
- CJEU, Case C-307/22, FT v DW, judgment of 26 October 2023
- CJEU, Case C-203/22, CK v Magistrat der Stadt Wien (Dun & Bradstreet Austria), judgment of 27 February 2025