What does the right of access entail?

The right of access gives people the right to view their personal data free of charge to verify whether an organization is processing the correct data correctly. In principle, you must respond within one month (extendable by two months for complex requests), verify the identity of the applicant carefully but in an accessible manner, and may only refuse the request in exceptional cases — always with justification.

Under the GDPR, individuals whose personal data is being processed have the right of access. Subsequently, they can request rectification or even erasure. All of this is free of charge.

The right of access in practice

In principle, the right extends to all personal data. This can be extensive; the requester may limit it, for example, to recorded telephone conversations. If the request is unclear, you can contact us to define its scope, or provide everything immediately.

In principle, you must respond and provide the information within one month. If the request is complex, let us know within that month why it is taking longer; you will then have up to two additional months.

Everyone whose data is processed has this right. For young people up to and including the age of 16, the parents or legal representatives submit the request, and you provide the data to them. A similar exception applies in the case of guardianship.

Verify identity — but with low barriers to entry

To prevent a data breach, you must verify the identity of the requester. According to the Dutch Data Protection Authority, requesting a copy of the ID often goes too far; resort to less restrictive measures first. For a webshop, for example, a login system with a personal username and password suffices, possibly supplemented with the last digits of the account number or an SMS code. Only if there is no other option may you request an ID — and then have it shown, not copied. Identity verification must never create a barrier: the right must be as easy to exercise as possible.

The court also acknowledged the obligation to provide identification (ECLI:NL:RBOVE:2021:1295). A person submitted a request for access to records to the municipality of Losser without a signature or ID, providing only initials, surname, and a PO box number. The municipality requested identification; when this was not forthcoming and a month passed, the petitioner took the matter to court. The municipality was ordered to pay a penalty, but the petitioner was nevertheless required to identify themselves within two weeks.

May I refuse a request for access?

Refusal is permitted, but only in exceptional cases and must always be timely and substantiated. Consider abuse of the right of access where the administrative burden becomes extremely high due to repeated requests, or if public safety is jeopardized.

Frequently Asked Questions

Within what timeframe must I respond to a request for access?

In principle, within one month. In the case of a complex request, you may extend this period by a maximum of two months, provided that you notify us of this with reasons within the first month.

May I request a copy of the passport?

Preferably not. The AP often considers that to be too great an infringement. Use less restrictive identification methods; only require ID to be shown (do not copy) if there is absolutely no other option.

May I refuse a request for access?

Only in exceptional situations, such as clear abuse or a threat to public safety. You must communicate the refusal in a timely and reasoned manner.

Help with GDPR requests

Incorrect handling of an access request can lead to complaints and fines. The privacy experts at MKB Juristen help you handle requests correctly. View our expertise in privacy and data protection or schedule a free intake consultation .