Answer a GDPR access request without undue delay and within one month of receiving it. You can extend by two further months for complex or numerous requests, but you must tell the requester within the first month and explain why. Requests are free unless manifestly unfounded or excessive.
Step 1: log it and start the clock
Record the date of receipt the moment any employee gets a request. The request does not have to use special words or a form. Train customer support and sales to forward anything that looks like one. Article 12 applies the same one month rule to the other individual rights in Articles 15 to 22, so the same intake works for erasure, rectification and objection.
Step 2: confirm who is asking
You may not refuse a request on identity grounds unless you can show that you cannot identify the person. If you have reasonable doubts, you may ask for additional information to confirm identity. Keep this proportionate. Asking for a passport copy to confirm a newsletter subscriber is rarely justified when logging in to their account would do.
Step 3: search everywhere the data lives
Make a list of systems before the first request arrives. Your record of processing is a good start. Typical places:
- Production databases and backups.
- Support tools and email.
- Analytics and marketing platforms.
- Logs that contain identifiers.
- Processors holding data for you.
Processors must help you respond to rights requests under their contract, so send them a request with a deadline well inside your own.
Step 4: review before you release
Check each item for information about other people and for material you may have a basis to withhold. Record each decision. If you hold nothing, say so plainly.
Step 5: reply with the right content
Check Article 15 for the exact content of the right of access, which this post does not reproduce, and give the person what it requires. Send it securely and keep a copy of what you sent.
When you refuse or extend
If you decide not to act, tell the person without delay and at the latest within one month. State the reasons and tell them they may complain to a supervisory authority and seek a judicial remedy. For a request you say is manifestly unfounded or excessive, you carry the burden of showing that.
Quick check
Can we charge a fee?
Generally no. A reasonable fee or refusal is possible only for manifestly unfounded or excessive requests, and you must demonstrate that.
Can the person ask orally?
Information can be given orally on request, but only if the person's identity is proven by other means.
Keeping a current inventory of systems and assets makes this far faster. Safeguard's asset discovery helps you see what you run, which is a starting point for that list.
Sources
Last reviewed: 19 October 2026.
