🔐 Can you require a company to show you your personal data?

Yes

Quick answer

Yes — you have the right to learn whether a company processes your personal data and to receive a copy, and the myth that 'you have to pay for your own data' is misleading: the first copy is free. Under GDPR Article 15 anyone can make a request for access and obtain confirmation of whether their data is processed, a copy of it, and information about the purposes, recipients, storage period and their rights. The data controller must reply within 1 month (extending the deadline by a further 2 months in complex cases and giving notice). The request need not be justified — you do not have to explain why you want the data. The key thing people miss: the first copy is free, and the controller may charge or refuse only where requests are manifestly unfounded or excessive, especially if repetitive. A refused request can be complained about to VDAI or a court.

📋 The rules

Anyone can request confirmation and a copy of their data (GDPR Art 15)
The controller must reply within 1 month; in complex cases extend by a further 2 months
The first copy is free; you need not justify the request or explain the purpose
A charge or refusal is allowed only for manifestly unfounded or excessive requests
A refused request can be complained about to VDAI or a court

🔓 Exceptions

Repetitive or manifestly excessive requests may attract a reasonable fee or a refusal to act on them
Access may be limited where it would harm the rights and freedoms of others, such as disclosing other people's data
In some areas (for example a pre-trial investigation) special exemptions and separate rules apply

⚠️ Penalties & fines

Hiding data can cost a company dearly. If a controller fails to give effect to the right of access or otherwise breaches data protection rules, the person can complain to the State Data Protection Inspectorate (VDAI) or defend their rights in court. What people miss: GDPR breaches carry administrative fines of up to 20 million euros or up to 4 % of worldwide annual turnover — whichever is higher; VDAI has already imposed real fines for breaches of the right of access. Besides a fine, a person is entitled to claim compensation for damage, including non-material harm. In practice it is cheaper and safer for a controller to meet the request properly and on time than to risk an investigation and a fine. For the individual it matters to make the request in writing and label it clearly as an access request, so there is proof and a clear deadline.

📎 Official sources

Last verified: 2026-07-12

❓ Frequently asked

Can I demand my data from a company?

Yes, under GDPR Article 15 you have the right to learn whether a company processes your personal data and to receive a copy along with information about the processing. You do not have to justify the request in any way — you need not explain why you want the data.

Do you have to pay for a copy of your data?

The first copy of your personal data is provided free of charge, so the myth that you always have to pay for your own data is wrong. The controller may charge only for further copies or where requests are manifestly unfounded or excessive.

How soon must the company reply?

The data controller must reply to the request within one month of receiving it. In complex or numerous cases this deadline can be extended by a further two months, with notice and the reasons for the extension given.

What if they do not provide the data?

If the controller fails to give effect to the right of access or refuses without grounds, you can complain to the State Data Protection Inspectorate or go to court. In addition, you have the right to claim compensation for the material and non-material harm caused by the breach.

How much does a company face for a breach?

GDPR breaches carry administrative fines of up to 20 million euros or up to 4 percent of worldwide annual turnover, whichever is higher. VDAI has already imposed real fines for breaches of the right of access, so hiding data is expensive for a company.

🔎 Common searches

What people search to land here:

“how to get your data from a company”
“gdpr article 15 right of access”
“data access request lithuania”
“is a copy of my data free”
“where to complain about personal data”
“how long to answer a data request”