GDPR Subject Access Requests: Answering Correctly

What falls within the scope follows from Article 4(1) GDPR. Personal data there means "any information relating to an identified or identifiable natural person" (GDPR). That is broad and reaches well beyond name and address: order history, appointment records, payment details, complaint threads, notes in the customer record, submissions from the website form, email correspondence, photographs with a clear attribution. Pseudonymised data remain personal data as long as the link can be restored (EDPB Guidelines 01/2022). Anyone who reduces the answer to the master record in the till system has usually missed the scope of the provision.

Not every message that sounds like a request is one. Someone asking about delivery times is making a customer enquiry; someone asking which data you hold about them is making an access request. Conversely, a request is still a request when it sits inside a complaint letter, arrives through the messenger contact route or is made verbally at the counter. In its 2024 coordinated enforcement action the European Data Protection Board recorded that some responding controllers simply did not recognise access requests as such and could therefore neither track nor report them (EDPB).

The period starts when the request reaches the controller through one of its official channels; it is not necessary that anyone in the firm has already read it (EDPB Guidelines 01/2022). If the inbox rests over the summer break, the deadline does not rest with it. There is one suspension: where doubts about identity make a follow-up question necessary and that question is asked without undue delay, time stops until the data subject replies. As good practice the Board recommends confirming receipt in writing and stating from which day to which day the month runs (EDPB Guidelines 01/2022). That costs one text module and removes any later dispute about when the clock started — the same logic as with response times for ordinary enquiries, only with a statutory ceiling.

The European Data Protection Board is explicit here: requiring a copy of an identity document is disproportionate where the person making the request is already authenticated by the controller. Using such a copy creates a security risk of its own and should generally be considered inappropriate unless it is necessary, suitable and in line with national law (EDPB Guidelines 01/2022). Where a document is genuinely needed, details that are not required — serial number, nationality, height, eye colour, photograph and machine-readable zone — may be redacted before it is sent. Confirmation links by email, a code by text message or questions about details already held in the account are the more proportionate route.

Step five is the one that eats the time. Writing down in advance which systems hold customer data shortens every later search considerably. That list overlaps heavily with what you already gathered for the contracts with your service providers and with the overview of roles and access rights in the team. There is a side effect: knowing where data sit also helps to protect them, and the same overview keeps the attack surface of the website small.

In Germany the annual reports show how much the pressure has grown. The Bavarian Data Protection Authority recorded 9,746 complaints and inspection referrals in 2025, an increase of 61 per cent on the previous year; 67 per cent of them were formal complaints and 21 per cent inspection referrals (BayLDA). Despite the rise, 62 per cent of the formal complaints closed that year were dealt with within three months (BayLDA). The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg counted 7,673 complaints in the same year after 4,034 the year before (LfDI Baden-Württemberg). The subject split hits small firms directly: in Bavaria 21 per cent of complaints concerned internet and digital services and 20 per cent video surveillance (BayLDA).

What happens when a firm simply does not answer is described in the same report through a single case. A citizen wanted to know how a company unknown to her had obtained her data and received no reply. The authority ordered the controller to provide the information, at the controller's cost, and threatened penalty payments of 5,000 euros for the answer itself and 2,500 euros for confirming completion. After several rounds two fines totalling 50,000 euros were imposed; across the case penalty payments were threatened five times, adding up to 66,000 euros (BayLDA). The statutory ceiling itself sits in Article 83(5) GDPR: up to 20 million euros or up to 4 per cent of total worldwide annual turnover, whichever is higher (GDPR). For a trades business the ceiling is not the point; the road towards it is, and it starts with one unanswered email.