Wegweiser Citizens and Authorities · Your rights in administrative procedure Deutsch

🔐 Information about your data (Art. 15 DSGVO)

You can find out from an authority what data it stores about you. Reply usually within one month.

access request GDPR (DSGVO) Art. 15 data copy data protection officer complaint SGB X § 83

In brief

You have the right to find out whether an authority processes data about you. You can also ask for a copy of the data (Art. 15 DSGVO).

Write to the authority. State who you are and what you want. The authority must usually reply within one month. In complicated cases the deadline can be extended by two months.

Access is in principle free of charge. If the authority does not reply, you can complain to the data protection supervisory authority.

Step by step

  1. Determine the officeWhich authority holds data about you?
  2. Make the requestAsk for information under Art. 15 DSGVO and a copy; you do not need to give reasons.
  3. Prove your identityIf the authority asks, where there are doubts.
  4. Check the replyCheck completeness and the deadline.
  5. ComplainTo the data protection supervisory authority if no or wrong information is provided.

Deadlines

1 month
Reply to data subject requests; extension by up to two months for complexity or volume, with notice within the first month.Art. 12 Abs. 3 DSGVO
free of charge
Access is in principle free; for manifestly unfounded or excessive requests a reasonable fee may be charged or the request refused.Art. 12 Abs. 5 DSGVO
Watch out – common mistakes
  • The copy must not adversely affect the rights and freedoms of others (Art. 15 Abs. 4 DSGVO).
  • For social data, § 83 SGB X also applies, with its own exceptions. The state data protection acts (BayDSG, DSG NRW, BlnDSG) can also restrict access under Art. 23 DSGVO (not checked in full text).
  • Competent supervisory authority: for federal authorities the BfDI; for state and municipal authorities the state supervisory authority (BY, NRW, BE see below).
  • The right of access to data and access to files are different rights.
In depth · legal basis, figures and practice – for advisers and professionals

Content of the right

Art. 15 Abs. 1 DSGVO gives data subjects the right to confirmation of whether personal data is being processed, and to information in particular on the purposes of processing, categories of data, recipients, storage period, data subject rights, the right to complain, the origin of the data and automated decision-making. Under para. 3, a copy of the data must be provided; further copies can give rise to reasonable costs; for an electronic request, a commonly used electronic format must be used. Para. 4: no adverse effect on the rights of others.

Procedure

Art. 12 Abs. 3 DSGVO: notification without undue delay, in any case within one month; extension by two months. Art. 12 Abs. 5: free of charge. Where there are justified doubts, the authority may request additional information on identity. Under § 83 SGB X, the right of access lapses in certain circumstances, for example for social data stored only because of retention rules and where the effort would be disproportionate.

Complaint

The BfDI is responsible for federal authorities; complaints are not bound to any form (letter, e-mail, form). For state and municipal authorities, the state data protection authorities are responsible: Bavaria has two supervisory authorities (the Landesbeauftragte für den Datenschutz for the public sector; the BayLDA in Ansbach for the non-public sector), NRW the LDI NRW, Berlin the BlnBDI (not checked in full text; 13 Länder not checked).

Who is responsible
  • Authority as controller
  • BfDI (federal authorities)
  • State data protection authority (state and municipal authorities: BY Landesbeauftragter, NRW LDI NRW, Berlin BlnBDI; not checked in full text)
Further reading
Access to filesPetition and complaint

Quick questions

Worum geht es bei „Information about your data (Art. 15 DSGVO)“?
You can find out from an authority what data it stores about you. Reply usually within one month.
Which deadlines and figures matter?
  • 1 month: Reply to data subject requests; extension by up to two months for complexity or volume, with notice within the first month. (Art. 12 Abs. 3 DSGVO)
  • free of charge: Access is in principle free; for manifestly unfounded or excessive requests a reasonable fee may be charged or the request refused. (Art. 12 Abs. 5 DSGVO)
What should I do first?
  • Determine the office: Which authority holds data about you?
  • Make the request: Ask for information under Art. 15 DSGVO and a copy; you do not need to give reasons.
  • Prove your identity: If the authority asks, where there are doubts.
What do I need to watch out for?
  • The copy must not adversely affect the rights and freedoms of others (Art. 15 Abs. 4 DSGVO).
  • For social data, § 83 SGB X also applies, with its own exceptions. The state data protection acts (BayDSG, DSG NRW, BlnDSG) can also restrict access under Art. 23 DSGVO (not checked in full text).
  • Competent supervisory authority: for federal authorities the BfDI; for state and municipal authorities the state supervisory authority (BY, NRW, BE see below).
Evidence
  • dsgvo-gesetz.de, Art. 12 and Art. 15 DSGVO, retrieved 20 September 2026
  • Gesetze im Internet, § 83 SGB X, retrieved 20 September 2026
  • BfDI, complaints to data protection authorities; competence of the BfDI; right of access, bfdi.bund.de, retrieved 20 September 2026
As of

September 2026 · Sources and method

A question about your situation that this page does not answer? Write to us or use the contact form – we will tell you which office is responsible and what to bring. Free of charge, without individual legal advice.