5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Respond to GDPR access requests
Respond quickly, but do not disclose too much.
We support companies with access requests under Art. 15 GDPR, from deadline, identity and data sources to copy and redaction and a response that remains explainable before the authority and the court.
Please enter a short description first.
The first contact is free of charge. Before any costs arise, we tell you so explicitly.
Response within 24 hours on working days
As of: 23 October 2026
Access under Art. 15 GDPR and a copy of all data
We request information about all personal data of our client.Clarify scope
Please send a copy of all emailsin which he is mentioned.Check third-party rights
Claims for damages under Art. 82 GDPR are reserved.Link to a dispute
Point of review: A copy does not mean every document in full
- 1Classify the requestDeadline, identity, risk
- 2Clarify scopeSources, copy, limits
- 3Secure the responseResponse and evidence
Schematic illustration of an access request. Simplified example.
We advise on requests from
- Customers
- Employees
- Applicants
- Lawyers
What should you do first?
- Document the date of receipt and channel of the request. The one-month deadline runs from receipt. Art. 12 GDPR
- Check the identity, power of attorney and role of the requesting person.
- Define which systems and business units are searched, and plan redactions for third-party data.
Key points at a glance
- Under Art. 12(3) GDPR, companies must respond to an access request under Art. 15 GDPR without undue delay and in principle within one month.
- In our experience, the request is often also the start of preparing a complaint, a damages claim or an employment dispute.
- At ITMR, we clarify the deadline, identity, data sources, copy, redaction and limits and draft a response that can be substantiated.
- Even where abuse is suspected, we do not refuse hastily but document the indications.
- Your contact is Dominik Skornia and his team. He is an AI Privacy Expert (GDDcert. EU). Response on working days within 24 hours.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
Reason for instruction
When does an access request become a question of risk?
In our experience, an access request is rarely just a formal request. It needs a legal line as soon as deadlines are running, data sit in several systems or lawyers, former employees or complainants are asking.
A response without a clear scope, without limits and without documentation is risky.
The most important decision is made before the response. What is requested, who is affected, which data sources must be reviewed, which limits apply and what effect will the response have later in a complaint or proceedings?
A robust response does not come from a standard template. It combines data protection law, the technical data situation, internal responsibilities, documentation and the perspective of a later defence.
A good response is complete enough to fulfil the claim seriously. It is precise enough not to disclose unnecessary third-party data, trade secrets, internal assessments or defence positions.
- For whom
- Companies that have received an access request
- Deadline
- One month, extension of two months possible
- Provision
- Art. 12 and Art. 15 GDPR
- Copy
- Art. 15(3) GDPR
Deadline in view
Upload the request in the form. We will get back to you on working days within 24 hours with the deadline and a first assessment.
How it works
How do we answer an access request with you?
We keep the deadline in view and agree every step with you.
01
Classify the request You send the request, date of receipt, context and communication. We check what is needed now and whether a dispute, damages or contact with the authority is looming.
02
Clarify scope We define which systems, data categories, recipients, copies, third-party rights, trade secrets and restrictions go into the response.
03
Secure the response You receive a line for the response, redaction, reasoning and evidence, with reserves for a complaint, serial requests or a damages claim.
What we review in detail
- 1
Receipt, identity and scope Can the request be attributed, are there doubts about identity, is a power of attorney needed and how far does the request reach?
- 2
Data sources Which systems, business units, service providers and documentation must be included, and where is a precise limitation possible?
- 3
Copy, redaction and limits Which data must be disclosed, which passages redacted and how must third-party rights, trade secrets and confidentiality be taken into account?
- 4
Response, evidence and escalation We bring together deadline, content, tone and documentation so that the response remains robust in the event of a complaint, damages claim or court case.
How long does it take? We complete most work steps within a few working days. How fast it goes depends on the scope and on your responses. Do you have a fixed date, such as a deadline? Tell us right away in your enquiry and we will plan for it.
Service package
What do you have in hand after our review?
Service package: data subject access requests
Clear response strategy What is answered, what is limited, what is redacted and which tone fits towards the data subject, a lawyer or the authority?
Documented data scope Which systems, data categories, recipients, service providers and copies were reviewed, and why is this selection justifiable?
Documented line of defence Which decisions were taken, which risks remain and how can the response be explained later?
Response letter We draft the response and, if you wish, the accompanying letters on identity verification or extension of the deadline.
- For whom
- Companies and organisations
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Defence against damages claims and proceedings before the authority. These are separate services, on request.
Who delivers what and who decides
- Request and date of receipt
- Access to data sources
- Internal contacts
- Previous communication
- Deadline calculation
- Definition of scope
- Redaction concept
- Draft response and documentation
- Your company decides on the response
- In a dispute, the authority or the court
How does the engagement work?
- 1
First assessment You send the request using the form. We tell you the deadline and the initial review needed. The first contact is free of charge.
- 2
Offer Before work begins, we tell you the scope and costs transparently.
- 3
Court steps separately We agree court proceedings and representation before supervisory authorities separately if you wish.
Typical situations
Which situations make an access request difficult?
These are the six situations we see most often in our mandates.
The request has been received, but responsibility, identity, start of the deadline, extension and data sources are still open.
CRM, shop, customer service, HR, newsletter, email, cloud, logs and platform hold different data sets.
A lawyer, former employee, customer or complainant clearly links the access request to damages.
It is open which documents, extracts, messages, logs or notes must be disclosed as personal data.
The response touches on names, communication, appraisals, trade secrets, security information or the rights of others.
A missed deadline, incomplete response, complaint or damages claim can turn the request into a dispute.
Case groups
When is legal support particularly important?
Depending on the case group, the focus of the response shifts.
| Case group | Typical data | What matters |
|---|---|---|
| Employees and applicants | Personnel data, appraisals, emails, notes from managers | Precise delimitation in an employment dispute |
| Customers, shop and platform | Orders, tickets, logins, analytics, payment data, user accounts | Bringing scattered data together traceably |
| Access after a data breach | Incident documentation, notifications, logs | Connection with Art. 82 GDPR and contact with the authority |
| Lawyer's letter of claim | Access with a deadline, damages or injunction | Response as a line of defence |
| Automated decisions | Credit rating, fraud checks, matching, scoring, AI assessments | Higher duties to explain and provide evidence |
| International service provider chains | Cloud, group access, sub-processors, customer service | Naming recipients and transfers in full |
Serial requests
How do we deal with serial requests and suspected abuse?
Under Art. 12(5) GDPR, a request can be manifestly unfounded or excessive. This classification only holds with documented indications on purpose, timing, patterns, previous conduct and all circumstances.
A blanket refusal without documented indications weakens your position towards data subjects, the authority and the court.
We classify timing, request history, text patterns, demands, provision of data and publicly known approaches.
Depending on the situation, access, limitation, extension of the deadline, a notice on costs or refusal may be considered. What matters is the documented reasoning.
Avoid mistakes
Which mistakes do we see with access requests?
We check these points in every mandate.
- Forwarded too late The request sits internally and the one-month deadline effectively runs out.
- Only one system searched Customer service, HR, email, CRM, shop or logs are left out.
- No filing The response cannot later be substantiated before the authority or court.
- Privacy notices copied Specific data and recipients are not reviewed.
- No redaction Third-party data, appraisals or confidential information go out unchecked.
Abuse assumed The request is refused without documenting indications and circumstances.
Legal framework
Which rules apply to the right of access?
Art. 15(1) GDPR gives data subjects a right to confirmation and access to their data, purposes, recipients, storage period, source and automated decisions. Under Art. 15(3) GDPR, the controller provides a copy of the data.
Under Art. 12(3) GDPR, the response must be given within one month. For complex or numerous requests, an extension of two months is possible if the person is informed of the delay and the reasons within the first month.
Where there are reasonable doubts about identity, the controller may request additional information under Art. 12(6) GDPR. Under Art. 12(5) GDPR, it may refuse manifestly unfounded or excessive requests or charge a reasonable fee.
Under Art. 15(4) GDPR, the right to a copy must not adversely affect the rights and freedoms of others. According to the case law of the Court of Justice of the European Union, the copy includes extracts from documents where these are essential for understanding the data.
- General Data Protection Regulation (EUR-Lex) Art. 12 and Art. 15 GDPR on deadline, modalities, content and copy.
- EDPB Guidelines 01/2022 on the right of access European framework for the practical implementation of the right of access.
- Court of Justice of the European Union, judgment of 4 May 2023, C-487/21 Scope of the right to a copy under Art. 15(3) GDPR.
- Federal Data Protection Act National restrictions, in particular Section 34 BDSG.
Limits
Where are the limits of the right of access?
We limit the response where the law allows it and document the reasons.
- 1
Third-party rights Data of other persons and trade secrets can be redacted if their disclosure adversely affects the rights of others.
- 2
No refusal without reason A refusal for abuse requires documented indications. The burden of proof lies with the controller.
- 3
Decision in a dispute In a dispute, the authority or a court decides whether the response was complete.
Mistakes we see in practice
- The deadline is calculated from processing instead of from receipt.
- An extension of the deadline is not communicated within the first month.
- The copy is sent without checking third-party data.
- The response is not filed with date and content.
Your contact
Lawyer · AI-Privacy-Expert (GDDcert. EU) · External data protection officer
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
At ITMR, Jean Paul Bohne, Andreas Buchholz and Dr. Alexander Pleh hold the title of specialist lawyer for information technology law.
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“I had a very good experience with ITMR Rechtsanwälte in a file-sharing/copyright matter that was very stressful for me. … The matter was resolved out of court with a significantly reduced settlement amount. I would particularly like to thank Mr Skornia for the professional support and the fast handling of my case.” (translated from German)
“Very good advice and transparent pricing” (translated from German)
“Mr Bohne of ITMR turned out to be a stroke of luck in choosing a lawyer. …” (translated from German)
FAQ
What do companies ask about data subject access requests?
How quickly must we respond to a GDPR access request?
Without undue delay and in principle within one month under Art. 12(3) GDPR. For complex or numerous requests, an extension of two months is possible if you inform the person in good time.
Is a legal review worthwhile even for simple requests?
Yes, if the deadline, identity, data sources, copy, third-party rights, link to a dispute or risk of damages are unclear. In our experience, the effort arises later when the response has to be substantiated.
Does every email have to be disclosed?
Not automatically. It depends on whether data of the requesting person are affected and whether the copy is necessary for understanding. We also review third-party rights, trade secrets and statutory restrictions.
May we verify the identity of the requesting person?
Yes, where there are reasonable doubts under Art. 12(6) GDPR. The verification must remain proportionate and must not make legitimate rights unnecessarily difficult.
When can a request be limited or refused?
Only in special cases, for example manifestly unfounded or excessive requests, lack of identifiability or conflicting rights of third parties. We document the reasons carefully.
We classify when even a first access request can be excessive in the article Access requests and abuse .
What is critical with requests from former employees?
Employee data sit in personnel files, emails, appraisals, internal communication and logs. Access, copy, third-party rights and the employment law context must be separated.
What if the request is clearly preparing a damages claim?
Even then, we do not refuse hastily. The Court of Justice of the European Union has ruled that the purpose of the request is in principle irrelevant. We document indications and check whether abuse can be proven.
Is a standard template enough for the response?
A template provides structure but does not replace a review. The critical points lie in the specific scope: data sources, recipients, copies, redactions, service providers and automated decisions.
Which documents do you need for the first assessment?
The request, the date of receipt, previous communication, information on identity, systems concerned, internal responsibilities and any link to a dispute.
Next step
Have you received an access request?
We secure the deadline, define the scope, prioritise data sources and check the limits. This reduces the risk of an incomplete or overly broad response.
Helpful for your enquiry
- Request for information
- Date of receipt
- Previous communication
- Systems concerned
You can also submit documents after our first response.
Have your access request reviewed
Upload the request and state the date of receipt. We classify the deadline, scope and line of response.
Helpful are the request, the date of receipt, previous communication and the systems concerned.
Related services
Data protection law GDPR obligations, data subject rights and data protection organisation.Help with the supervisory authority When a complaint is already running or the authority is writing.DSGVO-Schadensersatz When the access request is linked to claims under Art. 82 GDPR.Data breach assistance When the access request follows a security incident.record of processing activities When documentation of processing is missing or outdated.Data protection audit When requests show that the overall status should be reviewed.
From our blog: Access requests and abuse · Access requests and scoring