Subject access requests under the GDPR: how to reply within one month

Published 11 November 2026

Summary: A person who makes a subject access request has the right to know whether you process personal data about them, to receive a copy of the data and to be told, among other things, the purposes, recipients and retention period (Article 15). You must reply without undue delay and within one month of receiving the request; the period may be extended by two months where necessary, but you must say so within the first month. The first copy is free, the person does not have to give reasons, and the identity check must be proportionate to the risk. Other people’s rights may mean that parts must be redacted or limited, but the starting point is to provide the rest rather than refuse the whole request.

What the person is entitled to

The GDPR calls it the right of access. It has three parts: confirmation of whether you process personal data about the person, a copy of the data and information about the processing. Under Article 15(1) and 15(2), the information covers:

• the purposes and the categories of personal data,
• recipients or categories of recipients, in particular in third countries,
• the retention period, or the criteria for it,
• the right to request rectification, erasure or restriction, to object and to complain to a supervisory authority,
• where the data come from, if not collected from the person,
• whether automated decision-making takes place, with meaningful information about the logic and consequences,
• the safeguards for transfers to a third country.

Much of this is in your record of processing activities and your privacy notice, but the European Data Protection Board (EDPB) says the reply must be tailored to the person asking. Recipients should as a rule be named: according to the Court of Justice, you must give the actual recipients unless it is impossible to identify them or the request is manifestly unfounded or excessive (Case C-154/21). The EDPB recommends that you also state the legal basis.

The deadline: one month from receipt

You must reply “without undue delay and in any event within one month of receipt of the request” (Article 12(3)). According to the EDPB, the period starts when the request reaches one of your official channels, even if the right person has not seen it. IMY (the Swedish Authority for Privacy Protection) and the EDPB explain how it is counted:

• The period ends on the same date the following month: a request received on 5 March is due by 5 April.
• If that date does not exist, the last day of the month applies: 31 August gives 30 September.
• If the last day is a Saturday, Sunday or public holiday, it moves to the next working day.

The period may be extended by two further months, taking into account the complexity and number of the requests. You must give notice of the extension and the reasons within the first month. According to the EDPB, a large effort alone does not make a request complex. If you will not act on the request, you must explain why within one month and mention the right to complain and to seek a judicial remedy (Article 12(4)).

Check identity, but no more than necessary

If you have reasonable doubts about identity, you may ask for the additional information needed to confirm it (Article 12(6)), but no more than necessary. On identity documents, IMY writes that requiring one “can be a security risk and should therefore only be required if it is strictly necessary and supported by law” (our translation).

• Use authentication you already have, for example a login or a one-time code to a phone number or email address on record.
• Do not ask for more than when the customer relationship began.
• If you have seen an identity document, note that it was checked instead of keeping a copy, as the EDPB recommends.
• If a representative makes the request, check the authorisation.

According to the EDPB, the period can be suspended while you wait for identity information, provided you asked for it without undue delay. So ask straight away.

Search, compile and send

According to the EDPB, you must search all IT systems and non-IT filing systems using criteria such as name and customer number. Think of email, shared folders, case systems, finance and HR systems and your processors’ services. The reply reflects the situation when the request arrived, so make sure the data requested are not erased while it is handled. Data already deleted under your retention rules cannot be provided.

The Court of Justice of the EU has held that the copy must be “a faithful and intelligible reproduction of all those data”, including extracts or entire documents where that is essential for the person to exercise their rights (Case C-487/21). According to IMY, an intelligible compilation is often enough, as long as the person can check that the data are accurate and lawfully processed.

If the request was made electronically, reply in a commonly used electronic form unless the person asks otherwise (Article 15(3)); according to the EDPB, PDF, for example, can work. Send the reply securely. Disclosing data to the wrong person can be a personal data breach.

Free of charge, and no reasons needed

The first copy is free; for further copies you may charge a reasonable fee (Article 15(3)). The person does not have to explain why they want the data. The Court of Justice has confirmed that the first copy is free even when the purpose is something other than checking the processing, in that case a possible damages claim (Case C-307/22).

If requests are manifestly unfounded or excessive, in particular because they are repetitive, you may charge a reasonable fee or refuse (Article 12(5)). According to the EDPB this is read narrowly, and you must be able to demonstrate it.

Other people’s data and Swedish exemptions

The right to a copy “shall not adversely affect the rights and freedoms of others” (Article 15(4)), for example colleagues’ names in an email or trade secrets. According to the EDPB, you must be able to show that others would actually be affected, and the answer is normally to redact those parts, not to refuse the whole request.

The Swedish Data Protection Act (2018:218) adds Swedish exemptions:

• The right does not cover data you may not disclose under an act or other statute, nor, for organisations that are not public authorities, data that would have been confidential at a public authority (Chapter 5, Section 1 (5 kap. 1 §)).
• Article 15 does not apply to drafts and memory notes, unless the data have been disclosed to a third party, are processed only for archiving purposes in the public interest or statistical purposes, or have been in a draft for more than one year (Chapter 5, Section 2 (5 kap. 2 §)).

Companies in which municipalities or regions have a legally controlling influence are also covered by public access to official documents (Public Access to Information and Secrecy Act, Chapter 2, Section 3 (2 kap. 3 §)), and a request for an official document follows other rules. According to the EDPB, a request is handled under the GDPR unless it is clearly made under other rules.

A template for the reply

1. Confirmation that you do, or do not, process personal data about the person.
2. The copy of the data, organised by system or context.
3. Purposes and categories of personal data and, as good practice, the legal basis.
4. Recipients, named where possible, and safeguards for transfers to third countries.
5. Retention period, source and any automated decisions.
6. The rights to rectification, erasure, restriction and objection, and the right to complain to IMY.
7. What has been redacted or withheld, and why.
8. Whom the person contacts with questions.

When the procedure is in place, you have an owner for requests, a log of dates, deadline, identity check, systems searched and dispatch, a list of where personal data are held and a reply template built on the record. In our division of the GDPR into 15 parts, this is part 11, data subject rights. To see where you stand, start with our GDPR self-test.

Would you like the procedure and reply templates in place before the next request arrives? In GDPR Start we produce a procedure for data subject rights with reply templates, as part of a working baseline. Read more about how Kristensson i Skåne AB works with data protection and privacy.

Sources: GDPR, Regulation (EU) 2016/679, Articles 12 and 15 (EUR-Lex); EDPB Guidelines 01/2022 on the right of access; IMY on data subject rights and on identification; Court of Justice of the EU, Cases C-154/21, C-487/21 and C-307/22; the Swedish Data Protection Act (2018:218), Chapter 5, Sections 1–2 (5 kap. 1–2 §§), and the Public Access to Information and Secrecy Act (2009:400), Chapter 2, Section 3 (2 kap. 3 §) (riksdagen.se). Verified 2026-10-03.

This text is general information and not legal advice. How a particular request should be handled depends on the facts.