Fr En
Diaporama

How to Respond to an Employee’s Request for Access to Their Personal Data Under Article 15 of the GDPR

Published on : 06/11/2026 06 November Nov 11 2026
Newsletter / Do’s and Dont’s
Newsletter

Any employee may request access to their personal data from their employer. For example, they may request a copy of their personnel file or information about how their data is processed (including why it is collected, how long it is retained, and to whom it is disclosed). The employer is required to respond; here are some guidelines to follow. 

DO

• Respond in a timely manner: acknowledge receipt within one month at most - Regardless of the situation, you must inform the employee of the action taken in response to their request within one month. This deadline may be extended by two months if the request is complex, but you must inform the employee of this extension before the end of the first month. Establish an internal process to ensure that all requests are quickly addressed to the appropriate contact person.

• Verify the requester’s identity and clarify the request if necessary - Make sure the person is who they claim to be. If the request involves a large amount of information, you can ask the employee to specify the data or processing operations in question. 

• Protect the rights of third parties and ensure secure transmission - Before sending the requested information in response, redact the identities of colleagues or any other individuals appearing in the documents, as well as any details that could indirectly identify them. Trade secrets and intellectual property must also be respected. When sending the response, generally use the same method as the request (if the request was sent by post, respond by registered letter with return receipt; if the request was sent by email, the response may be sent by email). Regardless of the transmission method chosen, ensure the security of the data being transmitted (e.g., a password-protected folder).

DON’T

• Do not disclose a third party’s data or allow a representative to act without proper authorization - The right of access is strictly personal: an employee may not obtain data concerning a colleague, nor may a spouse obtain data concerning their husband or wife. If a person is acting on behalf of an employee (e.g., an attorney), they must present a letter of authorization specifying the purpose of the authorization (exercise of the right of access), the identity of the principal and that of the authorized and provide proof of their own identity and that of the employee. In any case, do not disclose data to anyone whose status has not been verified.

• Do not provide a partial response or a mere list - It is not sufficient to merely confirm that you hold data or to list its categories: the employee is entitled to an actual copy of their data, provided they have explicitly identified it. When a data subject wishes to exercise their right of access to emails, the employer must provide both the metadata (timestamps, recipients, etc.) and the personal data contained in the emails.

• Do not refuse or obstruct access without a valid reason - An ongoing dispute, such as one before the labor court, is not a valid reason for refusal. Refusal is permitted only in very limited cases (e.g., a manifestly excessive request, particularly a repetitive one, or when the data has been deleted). If you refuse, you must provide a justification and indicate the appeal right and deadlines for appeal. The CNIL (French Data Protection Authority) imposes significant penalties for unjustified refusals (for example, the CNIL recently imposed an administrative fine of €300,000 on an IT consulting firm that failed to respond to, or responded late to, several such requests).
Share on
Publish this article Share on LinkedIn Share on Facebook Send by E-mail

History

<< < 1 2 3 4 5 6 7 ... > >>