[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F15":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","15","Article 15","Right of access by the data subject",82,"General Data Protection Regulation","**What it asks for.** Individuals have the right to confirmation of whether their personal data are being processed and, if so, access to the data and information including purposes, categories, recipients, retention, their rights, the source of the data and the existence of automated decision-making. The controller must provide a copy of the data, and the right of others must not be adversely affected.\n\n**In practice.** Organisations run a defined process for access requests: identity verification proportionate to the risk, searches across all relevant systems, review for third party information and a complete, understandable response within the time limits in Article 12. Evidence includes a request log, response times and examples of responses.\n\n**Common gaps.** Searches often miss email, chat, logs and processor systems. Responses can also be delayed beyond the deadline or redact more than is justified.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_15","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"bulgarian-court-rules-gdpr-article-15-violated-by-incomplete-data-access-response","Bulgarian Court Rules GDPR Article 15 Violated by Incomplete Data Access Response","2026-10-14T12:20:34.389+00:00",{"slug":23,"title":24,"published_at":25},"court-orders-gambling-operator-to-honour-gdpr-data-access-request-after-unlawful-refusal","Court Orders Gambling Operator to Honour GDPR Data Access Request After Unlawful Refusal","2026-10-12T10:20:23.374+00:00",{"slug":27,"title":28,"published_at":29},"google-ordered-to-provide-complete-data-copy-after-incomplete-gdpr-access-request","Google Ordered to Provide Complete Data Copy After Incomplete GDPR Access Request","2026-10-09T12:21:26.776+00:00",{"slug":31,"title":32,"published_at":33},"google-ordered-to-provide-full-gdpr-data-access-after-excluding-cookie-and-tracking-data","Google Ordered to Provide Full GDPR Data Access After Excluding Cookie and Tracking Data","2026-10-09T12:21:11.713+00:00",{"slug":35,"title":36,"published_at":37},"austria-dsb-rules-us-streaming-service-violated-gdpr-transparency-requirements","Austria DSB Rules US Streaming Service Violated GDPR Transparency Requirements","2026-10-02T10:21:23.507+00:00",{"slug":39,"title":40,"published_at":41},"italian-dpa-fines-company-20000-for-ignoring-employee-data-access-rights-and-gps-transparency-failur","Italian DPA Fines Company €20,000 for Ignoring Employee Data Access Rights and GPS Transparency Failures","2026-09-23T11:20:23.2+00:00",{"slug":43,"title":44,"published_at":45},"slovenian-institution-fails-to-identify-breach-victims-or-honor-access-rights","Slovenian Institution Fails to Identify Breach Victims or Honor Access Rights","2026-09-23T08:22:01.404+00:00",{"slug":47,"title":48,"published_at":49},"italian-dpa-fines-la-patria-39k-for-ignoring-employee-gdpr-access-rights","Italian DPA Fines La Patria €39K for Ignoring Employee GDPR Access Rights","2026-09-23T08:20:24.768+00:00",{"slug":51,"title":52,"published_at":53},"securitas-direct-fined-100k-for-obstructing-gdpr-data-subject-rights-via-chargeable-helpline","Securitas Direct Fined €100K for Obstructing GDPR Data Subject Rights via Chargeable Helpline","2026-09-22T12:21:33.821+00:00",{"slug":55,"title":56,"published_at":57},"italian-dpa-fines-la-patria-20000-for-mishandling-gdpr-data-subject-access-requests","Italian DPA Fines La Patria €20,000 for Mishandling GDPR Data Subject Access Requests","2026-09-21T14:21:19.953+00:00",{"slug":59,"title":60,"published_at":61},"romanian-railway-company-fined-for-refusing-gdpr-data-access-request-1789554040811","Romanian Railway Company Fined for Refusing GDPR Data Access Request","2026-09-16T10:20:40.556+00:00",{"slug":63,"title":64,"published_at":65},"court-overturns-dpa-ruling-balancing-gdpr-access-rights-against-legitimate-institutional-interests","Court Overturns DPA Ruling: Balancing GDPR Access Rights Against Legitimate Institutional Interests","2026-09-16T09:21:51.994+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",19,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",14,{"slug":78,"name":79,"problem":80,"stories":81},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",11,{"slug":83,"name":84,"problem":85,"stories":86},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",2,{"slug":88,"name":89,"problem":90,"stories":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,{"slug":93,"name":94,"problem":95,"stories":91},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[97,103,108,113,119,124,129,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",70,{"family":104,"item":105,"code":106,"title":106,"together":107},"itil","overview","ITIL",59,{"family":109,"item":105,"code":110,"title":111,"together":112},"nist-privacy","Privacy Framework","NIST Privacy Framework",55,{"family":114,"item":115,"code":116,"title":117,"together":118},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",47,{"family":5,"item":120,"code":121,"title":122,"together":123},"12","Article 12","Transparent information, communication and modalities for the exercise of the rights of the data subject",35,{"family":5,"item":125,"code":126,"title":127,"together":128},"5","Article 5(1)(f)","Principles relating to processing of personal data",34,{"family":5,"item":130,"code":131,"title":132,"together":133},"13","Article 13","Information to be provided where personal data are collected from the data subject",22,{"family":5,"item":135,"code":136,"title":137,"together":138},"22","Article 22","Automated individual decision-making, including profiling",15]