When you want to inspect your data
The controller is required to tell you whether it is processing personal data concerning you.
You have the right to inspect which of your personal data different controllers are processing. Thus, you can also verify the accuracy of the data concerning you.
Personal data refers to information by which you can be identified.
A company, authority or corporation that collects your personal data is called a controller.
The controller is required to provide you with a copy of your personal data processed by it. As a rule, the copy is provided free of charge. If you request more than one copy, the controller is entitled to charge a fee to cover the costs.
You also have the right to obtain information on the following matters from the controller:
the source from which your personal data was collected
- why your personal data is necessary
- for how long your personal data will be necessary
- whether your personal data has been disclosed or will be disclosed – and if yes, to whom
- whether your data has been transferred to outside the EU – and if yes, how has it been protected
- whether automated decision-making is used in processing your data – and if yes, what does it mean
- how you can exercise your rights with regard to your personal data.
You can receive this information on paper, electronically in a commonly used file format or verbally.
How to proceed
Make the inspection request directly to the controller. Additional information on the correct channels can usually be obtained from the controller's website or customer service.
In the request, state
- which data you wish to inspect
- whether you wish to inspect all of your data or data from a certain period of time
- in what form you would like the data
- your name and
- your contact details (such as your e-mail address or telephone number).
The controller is required to reply to your request within one month. If the requests are numerous or complex, the controller can reply that it needs more time to process them. If the controller announces that it needs more time for processing, the deadline for replying will be three months from your original request. Wait for the controller's reply. Notifying you of a longer processing time does not mean that the controller will refuse to provide the information. If the controller does not reply to you within the deadline, you can contact the Data Protection Ombudsman.
If the controller refuses to provide the information you have requested, it must state the reasons for its refusal. The refusal must always be based on law. If you feel that the controller did not have legal grounds for its refusal, you can contact the Data Protection Ombudsman if necessary.
Notification to the Data Protection Ombudsman
How to inspect which of your personal data a competent authority is processing