Access requests in the business: the month runs from receipt

Access requests rarely arrive alone: they often mark the start of an employment dispute or a falling-out with a former business partner. That makes an established procedure all the more important.

What is owed

Data subjects are entitled to information about the data processed about them, including purposes, recipients, origin and the intended retention period, as well as a copy of the data. The response must be given without undue delay, in any event within one month. In complex cases an extension of a further two months is permitted – but only if you give reasoned notice of it within the first month.

Where the limits lie

Third-party rights and trade secrets justify redactions. They do not justify a blanket refusal: information must then be provided in restricted form, and the restriction must be reasoned. Ignoring the request completely is the surest way to a complaint to the data protection authority.

What should be settled in advance

Who is responsible when a request arrives by email at a general address? How is identity verified? Which systems are searched – including mailboxes, ticketing systems, logs? And how is the running of the deadline documented? Once these four questions are answered, most of the commotion is spared when the case actually arises.