Right of access — see everything a company holds on you (Art. 15)

The right of access (Art. 15) is the master key — without seeing what they hold, you can’t correct, delete or restrict anything. What you get: a copy of all your personal data, plus the purposes, the categories, every recipient or category of recipients it went to, the storage period, the source (if not you), whether automated decision-making is involved, and safeguards for transfers outside the EU. How to ask: an email is enough: “Under Article 15 GDPR I request a copy of all personal data you process about me, plus the Article 15(1) information.” No reason required. Send it to the privacy/DPO address in their privacy policy; big platforms also have self-service download tools (those often return less than a real Art. 15 request — you may insist on completeness). Identity: they may verify who you are, but must be proportionate — demanding a full unredacted passport copy for a newsletter database is not. Deadline: one month, extendable by two more for complex requests — they must tell you within the first month (Art. 12(3)). Cost: first copy free; only manifestly excessive repeat requests can be charged or refused, and the burden of proving “excessive” is on them. Limits: your copy may not harm others’ rights — expect lawful redactions of other people’s data. Silence or a fob-off? Follow Company ignores my request.