What it asks for. Individuals have the right to confirmation of whether their personal data are being processed and, if so, access to the data and information including purposes, categories, recipients, retention, their rights, the source of the data and the existence of automated decision-making. The controller must provide a copy of the data, and the right of others must not be adversely affected.
In practice. Organisations run a defined process for access requests: identity verification proportionate to the risk, searches across all relevant systems, review for third party information and a complete, understandable response within the time limits in Article 12. Evidence includes a request log, response times and examples of responses.
Common gaps. Searches often miss email, chat, logs and processor systems. Responses can also be delayed beyond the deadline or redact more than is justified.