Rett til innsyn i henhold til GDPR: hva du får og hvordan du håndhever den

Under Article 15 of the General Data Protection Regulation (GDPR, in Dutch the Algemene Verordening Gegevensbescherming or AVG) you may ask any organisation whether it processes personal data about you, and if so, receive a copy plus information on the purposes, recipients, retention period and source. The organisation must answer within one month and free of charge; it may only limit the copy where this is needed to protect the rights of others, such as third parties or business secrets.

If a company refuses or does not answer, you can ask the district court (rechtbank) for an order under Article 35 of the GDPR Implementation Act (Uitvoeringswet AVG, UAVG). You must do so within six weeks of the answer; if there was no answer at all, no deadline applies. Against a government body the route is objection (bezwaar) under the General Administrative Law Act (Awb).

What does Article 15 give you?

Article 15 gives you two things: confirmation whether your data are processed, and if so, access to those data with eight items of supporting information. Article 15(3) adds the right to a copy.

Under Article 15(2) you must also be told which safeguards apply when your data are transferred outside the EEA. A bare data dump without this context therefore does not meet Article 15.

Personal data is a wide category. Under the GDPR it includes assessments and opinions recorded about you, camera images, call recordings, IP addresses, log-in times and inferences drawn about you, as soon as they can be linked to you. The controller has to explain why something would fall outside it.

Who can ask, and who must answer?

The right belongs to the data subject: a living, identifiable person, regardless of age, nationality or residence. A parent or guardian can act for a minor; anyone else needs a written authorisation, which the controller may check.

The GDPR does not apply to data of deceased persons. Relatives may still have a route under Dutch rules, for example on access to a deceased patient’s medical file.

The request goes to the controller (verwerkingsverantwoordelijke): the party that decides why and how data are processed. A payroll bureau, hosting company or software supplier working on instructions is a prosessor and must pass the request on. Where two organisations are joint controllers under Article 26 GDPR, you may address either of them.

The GDPR also applies to controllers outside the EU that offer goods or services to people in the EU or monitor their behaviour. You can therefore send a request to a foreign platform; the one-month period starts when it receives the request.

Employees can use the right against their arbeidsgiver, for example to obtain their personnel file during a dismissal or performance dispute. The timing of the request is no reason to answer it differently.

What does “a copy” mean?

A copy must be a faithful and understandable reproduction of all personal data processed. The Court of Justice of the European Union (CJEU) has ruled that a summary or a list of categories is not enough.

The obligation concerns the data, not the documents they sit in. According to the CJEU, extracts from documents, whole documents or database extracts must still be provided where that is needed for you to understand the data and exercise your rights. An assessment, for example, often only makes sense within the report that frames it.

The CJEU has also ruled that you do not have to give a reason for your request. A motive unrelated to data protection, such as preparing a claim against the controller, does not make the request abusive, and the first copy must be free.

Redaction is allowed where a document also contains other people’s data. A meeting note about several employees can be released with the passages on colleagues removed, as long as the rest stays understandable. A document that concerns only you, such as your kontrakt og de generelle vilkårene applied to you, cannot be redacted.

Which deadlines, format and costs apply?

The controller must answer within one month of receipt (Article 12(3) GDPR). It may extend this by up to two further months for complex or numerous requests, but must tell you so, with reasons, within the first month.

If the controller decides not to act, Article 12(4) requires it to tell you within one month, with the reasons and your right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and to go to court. Silence is not an extension.

There is no required form. A request by emalje, letter, web form or orally is valid, and the controller may not insist on its own template. An electronic request is answered electronically unless you ask otherwise.

Access is free. A reasonable fee is only allowed for further copies (Article 15(3)), or where a request is manifestly unfounded or excessive, in particular because it is repetitive (Article 12(5)). The controller must prove that, and repetition alone is usually not enough.

Under Article 12(6) the controller may ask for extra information only if it has reasonable doubts about your identity. If an ID document is really needed, you may black out the citizen service number (BSN) and the photo. Demanding a full passport scan as standard is itself a breach; biometriske data are subject to stricter rules.

The copy must be sent securely, for example as a protected file with the password sent separately, or via a portal with two-factor authentication. Sending a whole personnel file unprotected to a private email address risks a data breach that must be assessed under Article 33 GDPR.

When may access be limited or refused?

Under Article 15(4) GDPR the copy may not harm the rights and freedoms of others. This allows partial redaction, but never a blanket refusal.

Recital 63 of the GDPR names business secrets and intellectual property, including software copyright, as interests that may be weighed. The limit applies to the copy, not to your right to the information in Article 15(1). The controller must choose the least restrictive solution, which is usually disclosure with redactions.

Tredjepartsdata

Emails, meeting notes and complaint files often contain data of several people. The controller may remove names and contact details of third parties or supply an extract, but may not withhold a whole document because a third party is mentioned in it.

Business secrets and legal privilege

Pricing models and source code can be protected, but you are still owed meaningful information about the logic of any automated decision under Article 15(1)(h). Communications covered by legal professional privilege are shielded; see our article on rapporteringsplikter og privilegier.

Restriksjoner i nederlandsk lov

Article 41 UAVG allows a controller to set aside data subject rights where necessary and proportionate, for example for national security, the investigation and prosecution of criminal offences, the independence of the courts, or the protection of the data subject or others. The controller must name the ground and apply it to your specific request; a general statement is not enough.

Medical files follow a parallel track. Under Article 7:456 of the Dutch Civil Code (BW) a care provider must give you access to and a copy of your file, unless this is needed to protect another person’s privacy. You can use both routes.

What can you do if the controller does not answer?

Send a dated reminder first, then go to the Autoriteit Persoonsgegevens or the court. Both routes can run at the same time.

In the reminder, refer to your original request and its date, state that the one-month period of Article 12(3) has expired, and set a short deadline of one or two weeks. Many requests are answered at this stage, and the reminder builds your paper trail.

Under Article 77 GDPR you can file a complaint with the Autoriteit Persoonsgegevens. The AP can investigate, order compliance, impose an order subject to a penalty (last onder dwangsom) or a fine. It does not award compensation, and handling a complaint can take months.

How does the court procedure work?

Against a company or other private party you file a petition (verzoekschrift) with the district court under Article 35 UAVG. The court can order the controller to grant the request.

• Deadline: six weeks after you received the controller’s answer (Article 35(2) UAVG).
• No answer within the Article 12(3) periods: no deadline applies.
• You do not need a lawyer to file the petition (Article 35(4) UAVG).
• The court can order the parties to provide written information and documents (Article 35(6) UAVG).

Against a government body (bestuursorgaan), the decision on your request counts as a decision (besluit) under the Awb (Article 34 UAVG). You then file an objection (bezwaar) within six weeks (Article 6:7 Awb), followed by an appeal to the administrative court.

In urgent cases you can start summary proceedings (kort geding). A claim for compensation under Article 82 GDPR can be added, but the CJEU requires you to prove actual damage; a breach alone is not enough. Awards in access cases are modest. Our overview of hvordan saksbehandlingen for en nederlandsk domstol forberedes forklarer hva man kan forvente.

Hva bør du sjekke som registrert?

A clear, well-scoped request is answered faster and is harder to stall. Before and after sending it, check these points:

• You refer explicitly to Article 15 GDPR and ask for both the copy and the information in Article 15(1)(a)-(h).
• You identify yourself with your customer or personnel number, and name the period, departments or systems you are interested in.
• You keep the sent request, note the date of receipt and diary the one-month deadline.
• You check the answer against all eight items of Article 15(1), not only the attachments.
• If you receive a written refusal from a company, you note the six-week deadline for the court petition.
• If data turn out to be wrong or excessive, you follow up with a request for rectification (Article 16) or erasure (Article 17).

Hva bør du sjekke som kontrollør?

Most failures are organisational: a request sent to a sales inbox or made by phone still starts the one-month period. Check these points:

• Staff recognise an access request in any form and forward it the same day to one responsible person.
• Your record of processing activities (Article 30 GDPR) shows where personal data are stored, including archived mailboxes and ticketing tools.
• You verify identity proportionately and never demand a full passport copy as standard.
• Third-party data are redacted with a second check, and every redaction or refusal is recorded with its legal ground.
• You send the copy with the Article 15(1) information within one month, or notify an extension with reasons within that month.
• You enforce retention periods: data lawfully deleted no longer have to be disclosed.

What can we do for you with a GDPR access request?

Som en del av vår IT-advokat practice, we act for both individuals and organisations:

• We draft your access request or reminder, scoped to the data and period that matter for your case.
• We check the controller’s answer against Article 15(1) and identify what is missing.
• We prepare and file the petition with the district court under Article 35 UAVG within the six-week deadline, or the objection against a government body.
• We draft the complaint to the Autoriteit Persoonsgegevens.
• For organisations: we set up a request-handling procedure and review redactions and refusals before they go out.

Sammendrag

• Article 15 GDPR gives you confirmation, a free copy of your personal data and eight items of supporting information.
• The controller must answer within one month; an extension of up to two months must be announced within that first month.
• Access may be limited to protect others, usually by redaction, never by a blanket refusal.
• Against a company you can petition the district court under Article 35 UAVG within six weeks of the answer, without a lawyer; with no answer, no deadline applies.
• Against a government body you file an objection within six weeks under the Awb.

Ofte stilte spørsmål