Wegweiser Society · Civil rights and participation Deutsch

🔐 Data protection and the right of access (GDPR)

You are entitled to know what data companies and authorities store about you. Answer usually within one month.

GDPR (DSGVO) right of access Art. 15 data protection erasure complaint supervisory authority BfDI

In brief

Under the General Data Protection Regulation (GDPR, DSGVO) you can request access to your data. This applies to companies, associations and authorities that process your data (Art. 15).

The body must answer without delay, at the latest after one month. In difficult cases it can extend the deadline by up to two months. It must then inform you within the first month.

If your request is not answered, you can complain to the data protection supervisory authority.

Step by step

  1. Identify the controllerWrite directly to the company or authority, preferably in writing.
  2. Request accessCite Art. 15 DSGVO and say what you want to know.
  3. Note the dateThe one-month period runs from receipt.
  4. ComplainIf there is no answer, turn to the responsible supervisory authority.

Deadlines

without delay, at the latest 1 month
Answer to a request under Art. 15 DSGVO.Art. 12 para. 3 DSGVO
+ up to 2 months
Extension for complex cases, with reasons given within the first month.Art. 12 para. 3 DSGVO
Watch out – common mistakes
  • The one-month period is a maximum period. The duty to answer without delay applies in addition.
  • Make your identity clear, otherwise the body may ask follow-up questions.
  • Keep copies of your request.
  • Access is not erasure: further rights are covered by separate articles of the DSGVO.
In depth · legal basis, figures and practice – for advisers and professionals

Legal basis

Art. 15 DSGVO grants the right of access. Art. 12 para. 3 DSGVO: access must be provided without delay, at the latest within one month of receipt of the request; the period can be extended by a further two months where necessary, taking into account the complexity and number of requests. The data subject must be informed of the extension, with reasons, within one month.

Supervision

The BfDI is responsible for federal authorities (Graurheindorfer Straße 153, 53117 Bonn; poststelle@bfdi.bund.de; tel. 0228-997799-0 according to bfdi.bund.de). For companies and state authorities, the state data protection authorities are usually responsible.

Who is responsible
  • Data protection officer of the controller
  • Federal Commissioner for Data Protection and Freedom of Information (BfDI)
  • State data protection authorities
Further reading
Freedom of information: information from authoritiesAdvice and contact points

Quick questions

Worum geht es bei „Data protection and the right of access (GDPR)“?
You are entitled to know what data companies and authorities store about you. Answer usually within one month.
Which deadlines and figures matter?
  • without delay, at the latest 1 month: Answer to a request under Art. 15 DSGVO. (Art. 12 para. 3 DSGVO)
  • + up to 2 months: Extension for complex cases, with reasons given within the first month. (Art. 12 para. 3 DSGVO)
What should I do first?
  • Identify the controller: Write directly to the company or authority, preferably in writing.
  • Request access: Cite Art. 15 DSGVO and say what you want to know.
  • Note the date: The one-month period runs from receipt.
What do I need to watch out for?
  • The one-month period is a maximum period. The duty to answer without delay applies in addition.
  • Make your identity clear, otherwise the body may ask follow-up questions.
  • Keep copies of your request.
Evidence
  • dsgvo-gesetz.de, Auskunftsrecht der betroffenen Person, retrieved 20 September 2026
  • Datenschutzbeauftragter Hamburg, Frist für Auskünfte: Unverzüglich, retrieved 20 September 2026
  • BfDI, bfdi.bund.de (address), retrieved 20 September 2026
  • EUR-Lex, Verordnung (EU) 2016/679 (DSGVO), CELEX 32016R0679, Art. 12 and 15
As of

September 2026 · Sources and method

A question about your situation that this page does not answer? Write to us or use the contact form – we will tell you which office is responsible and what to bring. Free of charge, without individual legal advice.