# Subject access requests (DSARs) and erasure requests: answer within one month, without panic URL: https://pulsaiq.com/en/guides/access-erasure-requests/ Last reviewed: 2026-10-23 Language: en Legal basis: GDPR Art. 12, 15 and 17 A process for subject access requests (DSARs) and erasure requests that you can repeat every time someone asks “what data do you hold on me?” or says “delete everything”. With deadlines counted to the day and seven reply templates ready to adapt. ## In two minutes - **Deadline: one month from receipt** of the request, even if nobody has read it yet. You can extend by two more months for complex or numerous requests, but you must tell the person, with reasons, *within* the first month. Art. 12(3) - **Free of charge.** You can charge a reasonable fee only for further copies, or refuse or charge for requests that are manifestly unfounded or excessive, and you must be able to show it. Art. 12(5); 15(3) - **No magic words.** An email to info@, a letter or a message to a colleague can be a valid request. The person doesn't have to give reasons or mention the GDPR. EDPB Guidelines 01/2022 - **Access** means a copy of the data plus eight specific pieces of information about how you use it. Pointing to your privacy notice is not enough. Art. 15 - **Erasure** has six grounds and five exceptions. Often the right answer is “we deleted this, we're keeping that until this date, for this reason”. Art. 17 ## Who this is for
This is for you if

Anyone in a small or mid-sized organisation who receives these requests (management, HR, customer service), and the data protection officers (DPOs) who support them.

This isn't for you if

Anyone looking for an analysis of access requests in litigation, or in public bodies with special rules. Talk to a lawyer for those.

Oficina Rocha, Marta, Inês, Rui and the people who write to them are fictional. The rules, deadlines and authority findings are real and sourced.

## “Send me everything you have on me” Marta is the office manager at Oficina Rocha, a 45-person furniture maker near Braga, in northern Portugal, with an online shop. She also “does GDPR”, on Friday afternoons. Today, clearing out the general info@ inbox, she finds this: > **From:** paulo.m…@gmail.com · **To:** info@ · 6 October, 22:47 > > Good evening. I left the company in June. I'd like to receive all the personal data Oficina Rocha holds about me. Thanks, Paulo Mendes The email is three weeks old. Marta's first reaction is a common one: “he sent it to the wrong address, does this even count?” It does. The clock started on 6 October and stops on 6 November. Ten days left. She calls Inês, the external DPO who supports the company. Inês stays calm: “Ten days is enough if we start today. Let's do this in the right order.” This guide is that order. This happens a lot. When Europe's data protection authorities looked at 1,185 organisations in 2024, one of the most frequent problems was failing to recognise requests that don't mention the GDPR or that arrive through channels not set up for them. And 74% of those organisations had received between zero and ten access requests the year before. With so few requests, nobody remembers the procedure when it's needed. Source: [EDPB, 2024 coordinated enforcement report on the right of access](https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf) (adopted 16 Jan 2025). ## Recognise the request The GDPR sets no form for a request. It can arrive by email, letter, phone, web form, social media or in person to a colleague. The person doesn't need to write “Article 15” or explain why they want the data. The European Data Protection Board (EDPB) is clear: you should not assess “why”, and you can't refuse just because the request doesn't mention the law. There is a sensible limit. If you've published a dedicated channel and someone writes to an address that has nothing to do with it (the EDPB's example is the cleaning staff's email), the request may not count. But a general address like info@ or customer support does, and the EDPB expects you to make “all reasonable efforts” to pass it on. Time the request spends lost in an inbox doesn't extend the deadline.

What to do now

Three habits, the same day
  1. 1Pass it onGive whoever reads shared inboxes (reception, info@, support, HR) one simple rule: any message asking for “my data”, “delete me”, “remove me” or similar goes to a named person the same day.
  2. 2Log itLog every request in a request log: date received, channel, type, deadline, owner.
  3. 3Acknowledge itSend an acknowledgement with the deadline. The EDPB recommends confirming in writing when the period starts and ends.Use template 1
[EDPB Guidelines 01/2022 on the right of access, v2.1](https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en), paras 13, 50, 52–57 and examples 8 and 9. ## Count the deadline to the day The GDPR says “one month”, not 30 days. The count follows the EU rules on time limits: the day the request arrives doesn't count, and the period ends on the same date the following month. If that date doesn't exist, it ends on the last day of the month. If it falls on a Saturday, Sunday or public holiday, it moves to the next working day. | Request received | One-month deadline | Why | |-------------------|--------------------|----------------------------------------------------------------------| | 6 Oct 2026 (Tue) | 6 Nov 2026 (Fri) | Same date the next month. This is Paulo's case. | | 31 Jan 2027 (Sun) | 1 Mar 2027 (Mon) | There is no 31 February, so 28 February. That's a Sunday, so Monday. | | 3 Mar 2027 (Wed) | 5 Apr 2027 (Mon) | 3 April is a Saturday, so the next working day. | Some authorities, including Portugal's CNPD, tell the public they can expect an answer within “30 days”. Working to 30 days is the safest way never to miss the month. **Extension.** You can add up to two months “where necessary, taking into account the complexity and number of the requests”. Two conditions: tell the person within the first month, and give the reason ([template 4](#r4)). An extension sent on day 35 is too late. **Also handling UK requests?** UK practice differs in places. The UK regulator, the ICO, says the clock pauses while you wait for clarification you have asked for, doesn't start until you have the identity information you requested, and that you only need to carry out a reasonable and proportionate search. That is UK guidance under the UK GDPR. For requests under the EU GDPR, follow the EDPB rules in this guide. [ICO, What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) Art. 12(3) GDPR; [Regulation (EEC, Euratom) No 1182/71](https://eur-lex.europa.eu/eli/reg/1971/1182/oj/eng), Art. 3; [CNPD, Right to erasure (PT)](https://www.cnpd.pt/cidadaos/direitos/direito-ao-apagamento-dos-dados/). ## Check identity, proportionately Ask for more information only when you have reasonable doubts about who is making the request, and only for what you actually need. The reflex of asking everyone for a copy of their ID card is a mistake: the EDPB says it is generally not an appropriate way to authenticate someone and creates a security risk. In their 2024 report, the authorities wrote that asking for an ID document indiscriminately “may constitute excessive processing”. Use what you already have. A customer with an account on the online shop can confirm through the account. A former employee can confirm something only they and the company know, or receive the reply at the contact details already on their file. In Paulo's case, his personal email was already on his HR record, so Inês didn't ask for anything else. If you really do need to check, ask in the first few days ([template 2](#r2)) so you don't burn the month waiting. Art. 12(6) and Recital 64 GDPR; EDPB Guidelines 01/2022, paras 73–77 and examples 13 and 14; [EDPB CEF 2024 report](https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf). ## Access: what you have to send An access reply has two parts. Think of it as a folder with a copy inside and a cover sheet on top.
Part A · Art. 15(3)

A copy of the data

A faithful and intelligible reproduction. It can include extracts from documents, or whole documents, where that's needed for the person to understand the data and exercise their rights. If the request came by email, reply in a commonly used electronic format.

The first copy is free, even if the person wants it for something else, such as preparing a legal claim.

Part B · Art. 15(1)

Eight pieces of information, made specific

  1. aWhy you use the data (purposes)
  2. bWhich categories of data you hold
  3. cWho you've shared it with. If the person asks, the actual recipients, not just categories
  4. dHow long you keep it, or the criteria
  5. eThe rights to rectification, erasure, restriction and objection
  6. fThe right to complain to a supervisory authority
  7. gWhere the data came from, if not from the person
  8. hAny automated decision-making or profiling, and the logic involved
Plus · Art. 15(2)If the data was transferred outside the European Economic Area, the safeguards that protect that transfer.

What the Court of Justice has already decided

C-154/21 · Österreichische PostActual recipientsIf the person asks, you name the actual recipients, not just categories, unless that's impossible or the request is manifestly unfounded or excessive.
C-487/21 · CRIFWhat a copy isA faithful and intelligible reproduction of the data.
C-307/22 · FTFirst copy freeThe first copy is free and the person doesn't have to justify the request.
Redact what belongs to others, don't refuseThe copy must not harm other people's rights (Art. 15(4)). Paulo's emails mention customers and colleagues. The answer is not to refuse, it's to redact what belongs to others and hand over the rest. The Court has also said that people are entitled to know when and why their data was consulted, but generally not the name of each employee who consulted it (C-579/21).
Art. 15 GDPR; CJEU [C-154/21](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0154), [C-487/21](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62021CJ0487), [C-307/22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62022CJ0307), [C-579/21](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62021CJ0579); EDPB Guidelines 01/2022. ## Where to look The authorities' number one finding in 2024 was searches that were too narrow: looking only in the main database and forgetting emails, metadata, non-text files or backups. They point out that you can't limit your reply to the data you consider relevant.
Six places to go through, one by one
The map already existsIf you have a record of processing activities, each row says what data you hold, why and where. The EDPB recommends using it for exactly this.
Guide 1: build your record in an afternoon
At Oficina Rocha, Rui from IT searched Paulo's name and email addresses across the mailboxes, the file server and the payroll software, and confirmed that June's CCTV footage had already been deleted in the normal cycle. It took a morning. Marta pulled the HR file. Inês reviewed everything and redacted customer and colleague details. [EDPB CEF 2024 report](https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf), challenge 1 and recommendations; Art. 30 GDPR. ## “Delete my account and everything you have on me” Paulo got his reply on 4 November, two days before the deadline. Marta can breathe again. Then a message comes in through the online shop's form from Sofia, a customer who bought a table in 2024 and gets the newsletter. Deleting everything sounds simple. But the table's invoice has Sofia's name and address on it, and tax law says it must be kept. The newsletter goes out through an external platform. And there are backups every night. Marta writes to Inês: “Do I delete it or not?” The answer: “Both. Let's work out which is which.” ## Erasure: when you must delete and when you can keep The right to erasure, also called the “right to be forgotten”, is not absolute. First check whether one of the grounds applies. Then check whether any exception applies, case by case and in writing.
1

You must erase, without undue delay, when

Art. 17(1)
  1. aThe data is no longer needed for the purpose it was collected for.
  2. bThe person withdraws consent and there's no other legal basis.
  3. cThe person objects (Art. 21) and there are no overriding legitimate grounds, or objects to direct marketing.
  4. dThe data has been processed unlawfully.
  5. eThere's a legal obligation to erase it.
  6. fIt was collected from a child in connection with online services (Art. 8).
2

You can keep it, as far as necessary, for

Art. 17(3)
  1. aFreedom of expression and information.
  2. bA legal obligation, or a task in the public interest.
  3. cPublic interest in the area of public health.
  4. dArchiving in the public interest, scientific or historical research, or statistics.
  5. eEstablishing, exercising or defending legal claims.
Sofia's case
Deleted
  • The online shop account, closed
  • Her browsing history and preferences
  • Her newsletter subscription
  • Her contact on the email marketing platform, at the company’s request
Kept
  • The invoice, because tax law requires it, but only for the legal retention period and only for that purpose
The reply to Sofia: template 6

Three places where organisations trip up

BackupsHalf of the authorities in the 2025 coordinated action raised concerns about backups. If you can't delete a single record from a backup, document when that backup expires, make sure the data isn't used again if a backup is restored, and tell the person.
“Anonymised” that isn'tSwapping a name for a code or masking half an email address is almost always pseudonymisation. The data is still personal data and the request hasn't been met.
Telling recipientsYou must pass the erasure on to every recipient the data was disclosed to, unless that's impossible or involves disproportionate effort, and tell the person who those recipients are if they ask.

Closing an account is not the same as erasing the data. The authorities have asked for more awareness of this difference, because many organisations treat them as one and the same.

Art. 17 and 19 GDPR; [EDPB 2025 coordinated enforcement report on the right to erasure](https://www.edpb.europa.eu/system/files/2026-02/edpb_cef-report_2025_right-to-erasure_en.pdf) (adopted 10 Feb 2026); [ICO, Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) (UK guidance, useful examples). ## Refuse or limit, and stay on solid ground You can refuse, or charge a reasonable fee, only if a request is manifestly unfounded or excessive, for example because it's repetitive. The EDPB says these terms must be read narrowly, and it's up to you to show that the request is one of them. A request repeated because your first answer was incomplete is just a reminder, not a new request. Don't use refusal to avoid work either. If someone asks for everything and you have years of data across many systems, you can ask whether they'd like to start with a particular area ([template 3](#r3)). But the EDPB warns that this request for specification must not be used to limit the reply. If they say “everything”, send everything. Whenever you don't act on a request, in whole or in part, you must reply within one month with your reasons and tell the person they can complain to a supervisory authority and go to court ([template 7](#r7)). Art. 12(4)–(5) and 15(4) GDPR; EDPB Guidelines 01/2022, para 29 and section 6. ## Seven things not to do
2024 · Right of access1,185 organisationsexamined by 30 authorities
2025 · Right to erasure764 organisationsexamined by 32 authorities, including Portugal's CNPD

These problems kept coming up.

  1. 1
    No written procedure.Seventeen authorities found organisations with no documented, up-to-date procedure for erasure. Some review theirs every five years, or never.
  2. 2
    Not recognising the request or acknowledging it.Requests that don't mention the GDPR, or arrive through channels not set up for them, go unanswered.
  3. 3
    Asking everyone for ID.Mandatory web forms, written-only requests and ID by default are all barriers to exercising the right.
  4. 4
    Searching only the main database.Emails, metadata, non-text files and backups get left out.
  5. 5
    Replying with the privacy notice.Generic information, recipients only as categories and vague retention periods instead of answers tailored to the person.
  6. 6
    Keeping the request log forever.Retention periods for the requests themselves ranging from six months to 45 years, or none at all. Set a period and store these records separately.
  7. 7
    Applying exceptions automatically.More than a dozen authorities saw Art. 17(3) exceptions applied without a case-by-case assessment, and refusals with no documented reason.
[EDPB CEF 2024 report (access)](https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf); [EDPB CEF 2025 report (erasure)](https://www.edpb.europa.eu/system/files/2026-02/edpb_cef-report_2025_right-to-erasure_en.pdf). ## The month, day by day

The same flow works for access and erasure. Days count from receipt of the request.

  1. Day 0Log. Log it and acknowledge.
  2. Days 1–5Verify. Identity, only if in doubt. Scope of the request.
  3. Days 5–20Collect. Search every system and vendor, using the record of processing as your map. For erasure: decide what goes, what stays, and why.
  4. Days 20–25Review. Redact third parties. Prepare the eight pieces of information.Extend now, if you need to
  5. By day 30Send. Reply, copy, proof of sending. Close the log entry.
## Seven replies ready to adapt Replace everything in \[square brackets\]. Write the way one person writes to another: these replies are read by the person who asked and, sometimes, by a regulator.
At the start
01AcknowledgementDay 0. For every request.
Subject: We've received your request – ref. [No.]
Dear [Name],

We received your request on [date received], asking for [summary: access to your personal data / erasure of your data].

We will reply by [deadline]. If the request turns out to be particularly complex and we need more time, we will let you know before that date and explain why.

Your request reference is [No.]. If you have any questions, just reply to this email.

Kind regards,
[Name]
[Role] · [Organisation]
Basis: Art. 12(3) GDPR. The EDPB recommends confirming in writing when the period starts and ends (Guidelines 01/2022, para 57).
02Identity checkOnly when there's a reasonable doubt. Send in the first few days.
Subject: Your request – ref. [No.] – confirmation
Dear [Name],

To protect your data, we need to be sure the request comes from you. In this case, [specific reason: the email you used isn't the one linked to your account].

You can confirm in either of these ways:
– [proportionate option 1: reply from the email address linked to your account]
– [proportionate option 2: give us the number of a recent order]

You don't need to send us a copy of an ID document. As soon as we have your confirmation, we'll carry on with your request.

Kind regards,
[Name] · [Organisation]
Basis: Art. 12(6) GDPR; EDPB Guidelines 01/2022, paras 73–77.
03Question about scopeFor large volumes of data. Never to limit the reply.
Subject: Your access request – ref. [No.]
Dear [Name],

We've started gathering your data. We hold information about you in [list: your HR file, work emails from [year] to [year], building access records].

So that we can send you what matters most to you first, is there a particular area or period you'd like to receive? If you'd prefer everything, just tell us and we'll send it all within the deadline, by [deadline].

Kind regards,
[Name] · [Organisation]
Basis: Recital 63 GDPR; EDPB Guidelines 01/2022, para 35(b). If you get no answer, carry on with the full request.
If you need more time
04ExtensionMust arrive within the first month, with the reason.
Subject: Your request – ref. [No.] – new deadline
Dear [Name],

We are working on your request of [date received]. We need more time because [specific reason: your data is held in seven different systems and includes around [N] emails over several years, which we need to review to protect other people's data].

For that reason, and as Article 12(3) of the GDPR allows, we are extending the deadline. We will reply by [new date, at most three months after receipt].

[Optional: In the meantime, please find attached [the part that is already ready].]

If you disagree with this extension, you can complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt].

Kind regards,
[Name] · [Organisation]
Basis: Art. 12(3) GDPR. Send before the end of the first month, with a specific reason.
In the final reply
05Access replyThe cover letter that goes with the copy of the data.
Subject: Reply to your access request – ref. [No.]
Dear [Name],

In reply to your request of [date received], please find attached a copy of the personal data we process about you [format: PDF file / password-protected zip folder, with the password sent separately].

1. Why we use your data: [specific purposes, e.g. managing your employment contract, running payroll, meeting tax and social security obligations].
2. What data we process: [categories: identification, contact details, bank details, attendance records, performance reviews].
3. Who we have shared it with: [actual recipients: social security authority, tax authority, [name of accounting firm], [name of insurer]].
4. How long we keep it: [period or criteria for each category].
5. Your rights: you can ask us to rectify, erase or restrict the processing of your data, or object to it.
6. You can complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt].
7. Where the data came from: [you provided it / we obtained it from [source]].
8. Automated decisions: [we do not make solely automated decisions about you / description and logic].
[If applicable: Transfers outside the EEA: [country, safeguard used].]

To protect other people, we have redacted [details of colleagues and customers] in [documents].

If anything is missing, or you have questions, just reply to this email.

Kind regards,
[Name] · [Organisation]
Basis: Art. 15(1)–(4) GDPR. Don't replace points 1 to 8 with a link to your privacy notice.
06Erasure confirmationFull or partial, with what stays and until when.
Subject: Your erasure request – ref. [No.]
Dear [Name],

We have dealt with your request of [date received].

What we deleted: [your online shop account, the order history shown in your account, your preferences, and your contact from our newsletter list].

What we have to keep: [the invoices for your purchases], because [specific legal obligation: tax law requires us to keep them for the legal retention period]. We will keep them only for that purpose and delete them on [date or criterion].

Who else we told: we asked [name of email marketing platform / other recipients] to delete your data.

Backups: your data still exists in backups made before today. Those backups are deleted automatically by [date], and we will not use your data again if a backup ever has to be restored.

If you disagree with this reply, you can complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt] or go to court.

Kind regards,
[Name] · [Organisation]
Basis: Art. 17(1) and (3), and Art. 19 GDPR. Check legal retention periods with your accountant.
07Reasoned refusalRare. Always with reasons and how to complain.
Subject: Your request – ref. [No.]
Dear [Name],

We have considered your request of [date received] and will not be acting on it [in full / in part: say which part].

The reason: [specific explanation, e.g. we answered an identical access request on [date] with a full copy of your data, and we have not processed any new data about you since. / The data you asked us to erase is needed to defend a pending court case, ref. [No.] (Article 17(3)(e) GDPR), and will be erased when the case ends.]

If you disagree, you have the right to complain to [supervisory authority, e.g. the CNPD in Portugal: www.cnpd.pt] and to go to court.

Kind regards,
[Name] · [Organisation]
Basis: Art. 12(4) and (5) GDPR. Keep an internal note of the assessment behind the refusal.
## An EU proposal targets “abusive” access requests In November 2025, the European Commission put forward the Digital Omnibus package, COM(2025) 837. For the right of access, it proposes three changes to Art. 12(5): allowing controllers to refuse or charge a fee when the right of access is used for purposes other than protecting one's data; lowering the burden of proof, so that it's enough for the controller to have “reasonable grounds to believe” a request is excessive; and, in a recital, treating “overly broad and undifferentiated” requests as excessive. The EDPB and the European Data Protection Supervisor (EDPS) agreed with the aim of giving more clarity, but asked for those three wordings to be removed (Joint Opinion 2/2026, 10 February 2026). They point out that, under the Court of Justice's ruling in C-307/22, people don't have to justify their requests. In October 2026, EU ambassadors had the Council's mandate for negotiations with the European Parliament on their agenda. The proposal is not law. **The rules in this guide apply today.** We'll update this box once a final text is published in the Official Journal. We look at the proposal in more detail, data breaches included, in our article on the Digital Omnibus. Separately, another proposal (Omnibus IV) is set to extend the exemption from keeping a record of processing to organisations with fewer than 1,000 people, except for high-risk activities (provisional agreement of 26 June 2026). Even if you're exempt, you'll still need to know where your data is to answer these requests. [COM(2025) 837](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837); [EDPB-EDPS Joint Opinion 2/2026](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf); [Coreper agenda, October 2026](https://data.consilium.europa.eu/doc/document/ST-13654-2026-REV-3/en/pdf); [Procedure 2025/0130(COD)](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0130%28COD%29). ## Checklist
0 of 10 checked
When it arrives
While preparing the reply
Before you press send
## Frequently asked questions ### How long do I have to answer an access request? One month from receipt, to the same day of the following month (Art. 12(3)). If the request is complex or you have many, you can extend by up to two more months, as long as you tell the person within the first month and explain why. ### Can I ask for a copy of an ID card to confirm identity? As a rule, no. You can only ask for more information when you have reasonable doubts about who is making the request (Art. 12(6)), and the EDPB considers a copy of an identity document generally not an appropriate means. Use what you already have, such as the customer account or the contact details on file. ### Can I charge for the copy of the data? The first copy is free, and the person doesn’t have to explain why they want it (C-307/22). You can only charge a reasonable fee for further copies (Art. 15(3)) or when the request is manifestly unfounded or excessive, which you must be able to show (Art. 12(5)). ### A customer asked for erasure. Do I have to delete the invoices too? No, as long as tax law requires you to keep them. The right to erasure doesn’t apply to the extent that processing is necessary to comply with a legal obligation (Art. 17(3)(b)). Keep only the invoice, only for that purpose and only for the legal period, delete the rest and explain this in your reply. ### Who answers the request: the company or the DPO? The company, as controller. The DPO advises, tracks the deadline and is a contact point for individuals (Art. 38(4)), but the decision and the reply belong to the controller. The guide for external DPOs with several clients explains where the DPO’s role ends. ### What if my reply sends someone else’s data by mistake? That is a personal data breach. Try to recall the message or ask for it to be deleted, record the incident and assess the risk: if there is a risk, you have 72 hours to notify the supervisory authority. The guide to the first 72 hours shows how to decide. ## Sources ### Legislation and case law - [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Art. 8, 12, 15, 17, 19, 21, 30, Recitals 63 and 64 - [Regulation (EEC, Euratom) No 1182/71](https://eur-lex.europa.eu/eli/reg/1971/1182/oj/eng), rules on time limits - [CJEU, C-154/21, Österreichische Post](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0154) (12 Jan 2023), recipients - [CJEU, C-487/21, F.F. v CRIF](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62021CJ0487) (4 May 2023), meaning of “copy” - [CJEU, C-579/21, J.M. v Pankki S](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62021CJ0579) (22 Jun 2023), consultation by employees - [CJEU, C-307/22, FT v DW](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A62022CJ0307) (26 Oct 2023), first copy free of charge ### European Data Protection Board (EDPB) - [Guidelines 01/2022 on the right of access, v2.1](https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en) (April 2023) - [2024 coordinated enforcement report, right of access](https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf) - [2025 coordinated enforcement report, right to erasure](https://www.edpb.europa.eu/system/files/2026-02/edpb_cef-report_2025_right-to-erasure_en.pdf) - [EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) ### National authorities and the legislative process - [CNPD (Portugal), Right of access](https://www.cnpd.pt/cidadaos/direitos/direito-de-acesso-aos-dados/) (in Portuguese) - [CNPD (Portugal), Right to erasure](https://www.cnpd.pt/cidadaos/direitos/direito-ao-apagamento-dos-dados/) (in Portuguese) - [ICO (UK), What should we consider when responding to a request?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/) - [ICO (UK), Right to erasure](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/) - [European Commission, COM(2025) 837, Digital Omnibus](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837) - [Council of the EU, Coreper agenda, 9 Oct 2026](https://data.consilium.europa.eu/doc/document/ST-13654-2026-REV-3/en/pdf) - [European Parliament, procedure 2025/0130(COD), Omnibus IV](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025%2F0130%28COD%29) **Last reviewed:** 21 October 2026. We review this guide whenever the rules or the authorities' guidance change. This guide is general information, not legal advice. For specific cases, talk to your DPO or a lawyer. Oficina Rocha and everyone in the scenes are fictional.