Article 15 Requests: What Your Tracking Must Disclose

What Article 15 actually demands

Article 15 has two halves, and everyday practice regularly shrinks it to the second one. Paragraph 1 first gives the data subject confirmation as to whether personal data are being processed at all, plus eight named pieces of information. Only paragraph 3 adds the obligation to provide a copy of the data themselves (Official Journal of the EU). Send a spreadsheet and you have done the smaller half and skipped the larger one: purposes, categories, recipients, storage period and origin are separate items of information, not a footnote to the file. On the copy, the Court of Justice of the European Union has clarified that the data subject must be given a faithful and intelligible reproduction of all those data (Court of Justice of the European Union). A raw table with column names such as dt and ev_t is faithful, but typically not intelligible.

For a website with audience measurement this means something concrete: the request covers not only the customer account, but every place where a link to a person can arise. The European Data Protection Board expects a search across all IT systems and non-IT filing systems, using search criteria that mirror how the information is structured (European Data Protection Board). Analytics, form analysis, session recording, server logs, error reports, newsletter delivery logs: each of these is a separate location. Draw that map only once the request has landed and you spend the deadline searching instead of answering. It belongs in the same documentation as the record of processing activities and the data protection impact assessment for web tracking.

• Purposes: what the data are processed for - with audience measurement typically usage analysis, not advertising targeting.
• Categories: which kinds of data arise, such as page views, time on page, device class, country of origin.
• Recipients: to whom the data were disclosed. The Court requires the identity of the recipients here, not merely their categories (Court of Justice of the European Union).
• Storage period: the envisaged period or, where that is not possible, the criteria used to determine it - the point at which a documented retention policy settles the answer in one sentence.
• Rights: rectification, erasure, restriction, objection and the right to lodge a complaint with a supervisory authority.
• Origin: any available information as to the source of the data where they were not collected from the data subject (Official Journal of the EU).
• Automated decisions: whether they exist and, if so, meaningful information about the logic involved.
• Third-country transfers: the appropriate safeguards under Article 46 where data reach a third country (Official Journal of the EU).

Decision point one: can you find the person in your data?

Article 11 covers the situation where the purposes of processing do not require identification. If the controller can demonstrate that it is not in a position to identify the data subject, Articles 15 to 20 do not apply - unless the data subject provides additional information enabling their identification (Official Journal of the EU). This is not a back door but an allocation rule with a clear counterpart: you may not collect extra data merely to be able to answer future requests. Recital 64 says so explicitly - a controller should not retain personal data for the sole purpose of being able to react to potential requests (Official Journal of the EU).

The European Data Protection Board draws the line with an example that applies directly to websites. A controller that maintains profiles for behavioural advertising and can address the person through the identifier in their terminal equipment can also link them for access purposes; under the guidelines that case does not fall within the scope of Article 11 (European Data Protection Board). If the same request arrives by email or ordinary mail, however, the controller is left with asking for additional information within the meaning of Article 12(6) - and that additional information is precisely the cookie identifier stored in the person's terminal equipment (European Data Protection Board). A controller measuring without an identifier in the terminal equipment simply has nothing to hand over at this decision point. It does, however, have to be able to demonstrate that, not merely assert it.

Decision point two: which source holds the data?

Once the link is possible, the source determines the scope. An account yields master data, form analysis yields field sequences, audience measurement yields timestamped events, a server log yields address data and request lines. These sources differ not only in content but in how they relate to a person: a server log contains the IP address as an immediate hook, cookieless measurement typically only a derived value that rotates regularly. Lump them together and you either disclose too much - adversely affecting the rights and freedoms of others, which is exactly what Article 15(4) rules out (Official Journal of the EU) - or too little. How a website determines the visitor address behind proxies in the first place is covered in the real visitor IP behind proxy and CDN.

The cookieless row is the heart of the workload difference. A controller measuring without an identifier in the terminal equipment keeps no recognisable profile and therefore cannot produce a personal copy at this point if the data subject contributes nothing. That is not an exemption but the consequence of a design decision taken long before the first request. It costs analytical sharpness for returning visitors and saves time on every single request. How usage can still be analysed meaningfully without a recognition identifier is shown in measuring attention through scroll depth instead of bounce rate.

The deadline: one month, three by exception

Information has to be provided without undue delay and in any event within one month of receipt of the request; that period may be extended by two further months where necessary, taking into account the complexity and number of the requests (Official Journal of the EU). The extension is not a silent step: the data subject must be informed within the first month of the extension and of the reasons for the delay. A controller that does not act at all owes, within one month at the latest, a notice of the reasons and of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy (Official Journal of the EU).

What will not carry an extension has been stated plainly by the European Data Protection Board: the mere fact that complying with the request would require a large effort does not make a request complex (European Data Protection Board). Nor does a request become excessive simply because answering it takes a vast amount of time and effort (European Data Protection Board). The person's motives are not a test either - data subjects are not obliged to give reasons or to justify their request (European Data Protection Board). In 2026 the Court of Justice of the European Union added, however, that even a first request may be regarded as excessive where the controller demonstrates, in the light of all the circumstances, an abusive intention (Court of Justice of the European Union). The burden of demonstrating that stays with the controller throughout (Official Journal of the EU). What does count as a legitimate reason for more time is a temporarily extraordinary volume of requests, for instance after unusual publicity around the organisation (European Data Protection Board).

What the authorities found

The European Data Protection Board's 2024 coordinated action is the broadest data point on this right so far. 30 data protection authorities launched coordinated investigations; 1,185 controllers from small and medium-sized enterprises, large companies and public bodies answered the questionnaires (European Data Protection Board). Seven challenges were identified, and one of them is the lack of documented internal procedures for handling access requests (European Data Protection Board). At the same time, two thirds of the participating authorities rated the level of compliance among responding controllers between average and high (European Data Protection Board). So having only an inbox and no procedure is not the exception but the documented norm.

Germany supplies the field data. The Bavarian Data Protection Authority recorded 9,746 complaints and requests for review in 2025, an increase of 61 per cent on the previous year (Bavarian Data Protection Authority). Its activity report also describes a case in which a controller left an access request unanswered, ignored a final administrative order and several threats of coercive fines, and was ultimately hit with two fines totalling 50,000 euros (Bavarian Data Protection Authority). The expensive part was not the disclosure but the silence. Which infringements otherwise become costly in practice is set out in avoiding typical GDPR fines.

The procedure: eight steps to an answer

A procedure is not a form but a sequence with an owner and a date. The chain below covers the standard case and leaves room at every point to record where a decision has to be documented. It does not replace legal advice on the individual case, but it prevents the most common failure: three weeks spent searching and the last day spent writing.

1. Record receipt. Note the date and the channel, because the month runs from receipt (Official Journal of the EU). A request is not bound to any form and need not contain the word access.
2. Link the person. Check whether a link succeeds with the means at hand. Only where there are reasonable doubts about identity may additional information be requested (Official Journal of the EU).
3. Clarify the scope. Where the controller processes a large quantity of information, it may request that the data subject specify the information or processing activities to which the request relates (Official Journal of the EU). That request is a relief measure, not a reason to wait.
4. Query the sources. Each location separately: account, forms, audience measurement, session recording, server logs, newsletter - and the systems of processors.
5. Check third-party rights. The right to obtain a copy must not adversely affect the rights and freedoms of others (Official Journal of the EU). As a rule that means redacting individual passages, not withholding the record.
6. Build the answer. The information from paragraph 1 in plain language, the copy as a readable file. Where the request was made electronically, the information is to be provided in a commonly used electronic form (Official Journal of the EU).
7. Deliver and log. Record the channel, the date and the scope. That log is the evidence later on, not anyone's recollection.
8. Plan for follow-up. A query back from the person is, as a rule, a continuation of the same case. Only a repeated, identical request after the case has been closed is a second request.

The copy: faithful and intelligible

In 2023 the Court of Justice of the European Union held that the right to obtain a copy means that the data subject is given a faithful and intelligible reproduction of all those data. The judgment goes further: extracts from documents or entire documents must be handed over where this is essential in order to enable the person to exercise their rights effectively - with the rights and freedoms of others taken into account (Court of Justice of the European Union). For measurement data that mainly means one thing: column names and keys need a translation. A value such as dt equals m is faithful but not intelligible; device class mobile is both. A legend next to the table typically satisfies the requirement better than renaming the raw data, because it leaves the delivered data set untouched.

from datetime import date

# Sources per site. None means: not queried - not "no records".
SOURCES = ("account", "forms", "analytics", "recording", "server_log", "newsletter")


def collect(subject_key, start, end, query):
    """Returns the triple (hits, measured, reason) per source."""
    result = {}
    for source in SOURCES:
        try:
            hits = query(source, subject_key, start, end)
        except LookupError as failure:
            result[source] = (None, False, str(failure))
            continue
        result[source] = (hits, True, "")
    return result


def deadline(received, extended=False):
    """One month by default, up to three months once the person is informed."""
    months = 3 if extended else 1
    year = received.year + (received.month - 1 + months) // 12
    month = (received.month - 1 + months) % 12 + 1
    return date(year, month, min(received.day, 28))


def complete(result):
    open_sources = [s for s, (_, measured, _) in result.items() if not measured]
    return not open_sources, open_sources


received = date(2026, 9, 21)
print("Standard deadline:", deadline(received))
print("with notification:", deadline(received, extended=True))

Two details decide the quality of the answer. First: a system that was not queried is not the same as a system with no records. Booking a failed query as no data means issuing a statement that was not measured - and that statement is exactly what will be contested later in a complaint procedure. Second: the information is provided free of charge (Official Journal of the EU). A fee only comes into play for further copies, and then as a reasonable fee based on administrative costs (Official Journal of the EU). Invoicing the first response turns an administrative task into grounds for a complaint.

Where the right of access ends

Article 15 is broad but not unlimited. The limits are narrower than everyday practice draws them, however, and each one is tied to a demonstration rather than an assessment. Whoever draws a limit should note in the same case file what it rests on.

1. Rights of others. The right to obtain a copy must not adversely affect the rights and freedoms of others (Official Journal of the EU). As a rule that means redacting individual passages.
2. Lack of identifiability. Only with a demonstration and with notice to the person where possible (Official Journal of the EU).
3. Manifestly unfounded or excessive. The controller bears the burden of demonstrating this (Official Journal of the EU); large effort alone does not suffice under the guidelines (European Data Protection Board).
4. Recipients not identifiable. Where it is impossible to identify the recipients, their categories may be given instead (Court of Justice of the European Union).
5. No retention for access purposes. Data must not be stored for the sole purpose of being able to react to potential access requests (Official Journal of the EU).

An access request does not measure your good intentions, it measures your data map. Know which system holds which column and you answer in hours; without that map you spend the deadline searching for the question.

— XICTRAQ

What to do next

The first step is not a legal text but a list. Write down which systems on your site produce personal data, which key you search them by, and who is allowed to run the export. That list answers the second decision point in advance. The second step is a decision on the first one: do you keep a recognition identifier in the terminal equipment, or do you measure without? Both answers are defensible, but they carry different downstream costs per request - and the decision belongs in writing before the first request arrives. How the two paths differ in daily operation is covered in the overview of GDPR-compliant website analytics.

The third step is a rehearsal. File a request against yourself, with a test identifier and a real time window, and measure how long assembly takes and which source returns nothing. What usually surfaces is not a missing form but a missing owner for a system nobody had on their list any more. For recordings it is worth looking at first-party session recording, because masking and export are particularly tightly coupled there. How the requirements have developed overall is summarised in the state of GDPR requirements for websites, and which features are in which plan is set out in the plan overview.