Skip to content
SimpleAct Logo

Guide · GDPR Art. 12–22

As of 4 October 2026

GDPR Data Subject Rights: Deadlines, Process and Deadline Calculator

Access, erasure, rectification, objection: data subject requests arrive by email, letter or contact form – and a one-month deadline starts on receipt. This guide gives you every right at a glance, the content of an Art. 15 answer, how to calculate the deadline and a calculator with a response plan.

Open the deadline calculatorAll rights at a glance
  • Every right in Art. 15–22 and 77
  • Content of an Art. 15 answer
  • Deadline calculator per EDPB guidelines
  • Data subject rights and AI systems
app.simpleact.de

Data subject requests

Demo Organisation Ltd · 4 open cases

A
  • Access (Art. 15)Customer · by email · Due 4 Nov 2026In progress
  • Erasure (Art. 17)Applicant · form · Due 21 Oct 2026Fulfilled
  • Objection (Art. 21)Newsletter subscriber · Due 16 Oct 2026Fulfilled
  • Access (Art. 15)Former employee · Due 9 Oct 2026Verify identity

Sample data · sorted by deadline

In short

Under Art. 15–22 GDPR, data subjects have the right of access, rectification, erasure, restriction, data portability and objection. The controller must respond without undue delay and at the latest within one month of receipt (Art. 12(3)). In complex cases the deadline can be extended by two months – with reasons given within the first month.

Basics

What data subject rights are – and what organisations must deliver

The GDPR gives every person whose data is processed a set of rights against the controller. At the core are Art. 15 to 22: access, rectification, erasure, restriction of processing, notification of recipients, data portability, objection and protection from solely automated decisions. On top come the information duties under Art. 13 and 14 and the right to lodge a complaint with a supervisory authority under Art. 77.

The rules for all requests are in Art. 12. The controller must facilitate the exercise of rights (para. 2), provide information in a concise, transparent, intelligible and easily accessible form (para. 1) and generally act free of charge (para. 5). Where the request is made electronically, the information should be provided electronically where possible (para. 3). The GDPR imposes no requirements on the form of the request, as the European Data Protection Board also stresses – an informal email is enough.

The key figure is the deadline: the controller provides information on the action taken without undue delay and in any event within one month of receipt of the request (Art. 12(3)). If it does not take action, it must explain why within one month as well, and point out the right to complain and to a judicial remedy (para. 4). The deadline can be extended by two further months where necessary, taking into account the complexity and number of requests – but the person must be informed within the first month, with reasons.

How the one-month period is calculated is set by Regulation (EEC, Euratom) No 1182/71, which the European Data Protection Board (EDPB) refers to in its Guidelines 01/2022 on the right of access: a request received on 5 March is due on 5 April. Where the corresponding day does not exist – received on 31 August – the deadline is the last day of the following month, 30 September. If the deadline falls on a weekend or public holiday, you have until the next working day. The calculator below does exactly that.

The period starts when the request reaches one of the organisation's official channels – not when the responsible person reads it. That is why requests sent to a personal inbox or to sales so often reach data protection too late. If the controller has reasonable doubts about the person's identity, it may request additional information (Art. 12(6)). According to the EDPB guidelines the period is then suspended until the information is received – provided the controller asked without undue delay.

Free of charge means: no fee for the first copy or any regular action. Only for manifestly unfounded or excessive requests – in particular because of their repetitive character – may the controller charge a reasonable fee or refuse to act; it bears the burden of proof (Art. 12(5)). For further copies under Art. 15(3), a fee based on administrative costs is permitted.

Infringements of data subject rights fall into the higher fine tier: Art. 83(5)(b) GDPR provides for up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. More important in practice: a missed or incomplete answer often leads to complaints to the supervisory authority and to compensation claims under Art. 82. A clean, deadline-driven process is the best prevention.

response deadline from receipt (Art. 12(3))
1 month
response deadline from receipt (Art. 12(3))
months extension for complexity – with reasons in the first month
+ 2
months extension for complexity – with reasons in the first month
or 4% of turnover: fine ceiling for breaches of Art. 12–22 (Art. 83(5))
€20m
or 4% of turnover: fine ceiling for breaches of Art. 12–22 (Art. 83(5))

Overview

Every GDPR data subject right at a glance

What every data subject can request, under which conditions and what you as controller must do. Exceptions are shortened – the legal text is authoritative.

Information
ConditionWhenever data is collected – no request needed
What you must doPrivacy notice with purposes, legal basis, recipients, retention, rights
Key limitsArt. 13(4), Art. 14(5)
ReferenceArt. 13, 14
Access
ConditionRequest by the person
What you must doConfirm whether data is processed; access to the data and the details in para. 1(a)–(h); copy of the data
Key limitsRights of others (para. 4); national restrictions, e.g. Section 34 BDSG in Germany
ReferenceArt. 15
Rectification
ConditionData is inaccurate or incomplete
What you must doRectify or complete without undue delay, also via a supplementary statement
Key limits–
ReferenceArt. 16
Erasure
ConditionOne of the grounds in para. 1, e.g. purpose no longer applies, consent withdrawn, objection, unlawful processing
What you must doErase without undue delay; for published data inform other controllers (para. 2)
Key limitsPara. 3, e.g. legal retention duty, legal claims
ReferenceArt. 17
Restriction
ConditionAccuracy contested, unlawful processing without wish to erase, data needed for legal claims, objection under review
What you must doOnly store the data; use only with consent or in the cases of para. 2; inform before lifting
Key limits–
ReferenceArt. 18
Notification of recipients
ConditionRectification, erasure or restriction carried out
What you must doInform every recipient; name the recipients to the person on request
Key limitsImpossible or disproportionate effort
ReferenceArt. 19
Data portability
ConditionProcessing is based on consent or contract and carried out by automated means
What you must doData provided by the person in a structured, commonly used, machine-readable format; directly to another controller where technically feasible
Key limitsRights of others (para. 4); public tasks
ReferenceArt. 20
Objection
ConditionProcessing based on Art. 6(1)(e) or (f); always for direct marketing
What you must doStop processing unless compelling legitimate grounds or legal claims; for direct marketing stop without balancing
Key limitsRight must be pointed out at the latest at first communication (para. 4)
ReferenceArt. 21
No solely automated decision
ConditionDecision based solely on automated processing with legal or similarly significant effects
What you must doOnly in the cases of para. 2; then right to human intervention, to express a view and to contest
Key limitsPara. 2(a)–(c)
ReferenceArt. 22
Complaint
ConditionThe person considers the processing unlawful
What you must doWhen refusing or not acting, point out the right to complain (Art. 12(4))
Key limits–
ReferenceArt. 77

Rights under Art. 15–22 are generally free of charge (Art. 12(5)). Doubts about identity justify follow-up questions (Art. 12(6)), not refusal.

Access under Art. 15

What a complete access response must contain

The right of access is by far the most common data subject right – and the most laborious. These details belong in every answer where data is processed. The right-hand column shows where to get them.

Confirmation
ContentWhether personal data of the person is processed – a negative answer is an answer too.
Where the information comes fromSearch across all systems
ReferencePara. 1, first part
The data itself
ContentAccess to the data and a copy of the personal data undergoing processing.
Where the information comes fromBusiness systems, email, file stores, processors
ReferencePara. 1, para. 3
Purposes
ContentWhat the data is processed for.
Where the information comes fromRecord of processing
ReferencePoint (a)
Data categories
ContentWhich types of data are processed.
Where the information comes fromRecord of processing
ReferencePoint (b)
Recipients
ContentRecipients or categories, in particular in third countries.
Where the information comes fromRoPA, list of processors
ReferencePoint (c)
Retention
ContentEnvisaged period or the criteria for it.
Where the information comes fromDeletion concept
ReferencePoint (d)
Rights
ContentRectification, erasure, restriction, objection; right to complain to a supervisory authority.
Where the information comes fromStandard text
ReferencePoints (e), (f)
Source
ContentAny available information on the source where data was not collected from the person.
Where the information comes fromRoPA (data source), CRM
ReferencePoint (g)
Automated decisions
ContentWhether Art. 22 applies; then meaningful information about the logic, significance and consequences.
Where the information comes fromAI inventory, system documentation
ReferencePoint (h)
Safeguards for third countries
ContentInformation on appropriate safeguards under Art. 46 for transfers.
Where the information comes fromDPA, standard contractual clauses
ReferencePara. 2
Format
ContentFor electronic requests in a commonly used electronic form, unless otherwise requested.
Where the information comes fromExport, PDF
ReferencePara. 3
Rights of others
ContentThe copy must not adversely affect the rights and freedoms of others – redact where needed.
Where the information comes fromCheck before sending
ReferencePara. 4

A record of processing with data source and systems answers points (a)–(g) almost completely. Gathering the data itself remains the laborious part.

Deadlines

Deadlines for data subject requests: what is due when

All deadlines run from receipt of the request. The examples follow Regulation 1182/71 and EDPB Guidelines 01/2022.

Answer on the action taken
DeadlineWithout undue delay, at the latest 1 month after receipt
ReferenceArt. 12(3), first sentence
Extension for complexity or number of requests
DeadlineBy 2 further months
ReferenceArt. 12(3), second sentence
Informing about the extension, with reasons
DeadlineWithin 1 month of receipt
ReferenceArt. 12(3), third sentence
Explaining refusal or inaction, pointing to complaint and remedy
DeadlineWithout delay, at the latest 1 month after receipt
ReferenceArt. 12(4)
Follow-up on doubts about identity
DeadlineAsk without undue delay; period suspended until the reply
ReferenceArt. 12(6); EDPB Guidelines 01/2022
Example: received 5 March
DeadlineDue 5 April
ReferenceReg. 1182/71 Art. 3(2)(c)
Example: received 31 August
DeadlineDue 30 September (last day of month)
ReferenceReg. 1182/71 Art. 3(2)(c)
Deadline on Saturday, Sunday or public holiday
DeadlineNext working day
ReferenceReg. 1182/71 Art. 3(4)
Rectification, erasure
DeadlineWithout undue delay
ReferenceArt. 16, Art. 17(1)

According to the EDPB guidelines the extension is an exception and should not become the rule. Organisations that extend often should improve their process.

Interactive

Deadline calculator and response plan

Enter the date of receipt and choose the type of request. You see the deadline, the end of a possible extension and the steps to complete by then. Nothing is stored or transmitted.

Type of request

Public holidays are not considered – if the deadline falls on a holiday where you are, the next working day applies.

app.simpleact.de

Deadlines and plan

Access · Art. 15

A

Choose a date of receipt.

Response plan

  1. 1Log the request, note the deadline
  2. 2Verify identity – if there is reasonable doubt, ask straight away
  3. 3Search all systems, including email, file stores and processors
  4. 4Compile the details under Art. 15(1)(a)–(h) from the RoPA
  5. 5Prepare the copy, redact third-party data (para. 4)
  6. 6Send the answer in a common electronic format, document dispatch

A working aid, not legal advice. The calculation follows Reg. 1182/71 and EDPB Guidelines 01/2022; when in doubt, answer earlier.

Data subject rights and AI

Data subject rights with AI systems: what else to consider

GDPR rights also apply to data that passes through AI systems. Some questions become sharper there. These points are our recommendation.

01

Access covers prompts and logs

If an AI tool stores inputs, histories or outputs relating to a person, they belong in the access response. Agree with the vendor how a person's data can be found and exported – ideally in the DPA (Art. 28(3)(e)).

02

Logic of automated decisions

If a system makes decisions under Art. 22(1), meaningful information about the logic involved, significance and consequences belongs in the answer (Art. 15(1)(h)).

03

Erasure and trained models

If data was used for training, erasure inside the model is often hard to achieve. All the more reason to decide beforehand whether personal data may go into training at all.

04

Rectifying wrong outputs

If a system produces inaccurate statements about a person that are stored or reused, Art. 16 applies. Processes for correction and flagging should be in place beforehand.

05

Objection to profiling

Profiling based on Art. 6(1)(e) or (f) is covered by the right to object; for direct marketing without balancing (Art. 21(1), (2)).

06

Explanation under the AI Act

For decisions based on Annex III high-risk AI, Art. 86 AI Act grants a right to explanation; deployers inform affected people about the use (Art. 26(11)). Following the Digital Omnibus, this information duty applies to Annex III systems from 2 December 2027. Art. 86 itself was not postponed; since high-risk classification under Annex III only applies from that date, the right to explanation becomes relevant in practice from then.

The AI Act rights supplement the GDPR rights; they do not replace them.

Approach

Handling data subject requests in 7 steps

How an email in the wrong inbox becomes a case answered on time. The process is a recommendation from practice.

  1. 1

    Define intake channels

    Name one address or form and train sales, support and reception: every request goes to data protection the same day. The deadline runs from receipt, not from forwarding.

  2. 2

    Log and set the deadline

    Date of receipt, type of request, channel. Calculate the deadline and possible extension at once and assign an owner.

  3. 3

    Verify identity

    Only as much as needed: matching against existing data is often enough. Ask immediately if there is reasonable doubt (Art. 12(6)) – no ID copies just in case.

  4. 4

    Find the data

    Use the record of processing as a map and search all systems, including email, file stores and processors.

  5. 5

    Check and decide

    Check conditions and exceptions, consider the rights of others, document the decision.

  6. 6

    Respond

    Clearly and plainly; electronically if the request was electronic. When refusing, give reasons and point out the right to complain and to a remedy.

  7. 7

    Document

    Record case, assessment, answer and dispatch. The documentation is your evidence under Art. 5(2) – and the basis for improving the process.

Limits

When you may restrict or refuse a request

The GDPR knows only a few reasons to refuse a request. For manifestly unfounded or excessive requests – in particular because of their repetitive character – the controller may refuse or charge a reasonable fee; it must demonstrate the character of the request (Art. 12(5)). If it cannot identify the person and demonstrates this, it may also refuse (Art. 12(2) with Art. 11(2)).

There are also right-specific limits: erasure does not apply, for example, where a legal retention obligation exists or the data is needed for legal claims (Art. 17(3)). The copy under Art. 15 and data portability must not adversely affect the rights and freedoms of others. National law can add restrictions; in Germany, Section 34 BDSG restricts the right of access under further conditions, for example for data stored only because of statutory retention rules.

A refusal is also an answer with a deadline: within one month the reasons must be given and the right to complain to a supervisory authority and to seek a judicial remedy pointed out (Art. 12(4)). A refusal without documented reasons is hard to defend in a complaint.

  • Manifestly unfounded or excessive – with evidence
  • Person cannot be identified (Art. 11(2))
  • Exceptions of the respective right, e.g. Art. 17(3)
  • Rights of others (Art. 15(4), Art. 20(4))
  • National restrictions, e.g. Section 34 BDSG

Common mistakes

Six mistakes with data subject requests

Deadline counted from forwarding

The deadline runs from receipt by the organisation. A request that sat in the sales inbox for two weeks has only two weeks left.

Form or ID demanded

An informal request is enough. An ID copy only where there is reasonable doubt; where the person is already authenticated, the EDPB considers it disproportionate.

Only master data disclosed

Access also covers emails, notes, logs and data held by processors – plus the details under points (a)–(h).

Extension without notice

The extension only works if the person is informed within the first month, with reasons.

Erasure despite retention duty

Where commercial or tax law requires retention, data is restricted instead of erased – and the person informed.

Data sent to the wrong person

Sending without verification to an unknown address causes a personal data breach of its own.

With SimpleAct

Data subject requests in SimpleAct

The GDPR module (from Professional) turns every request into a case with a calculated deadline, a status and a response package.

  • Request types under Art. 15, 16, 17, 18, 20 and 21
  • Deadline calculated from the date of receipt
  • List sorted by deadline, overdue cases flagged
  • Status from "received" to "fulfilled" or "rejected"
  • Internal logging or public form with email confirmation
  • Response package as ZIP with RoPA extract, privacy notices and processors

The response package is a draft

It contains your organisation's structural information, not the person's specific data from your business systems. You check identity and content yourself before sending.

See the GDPR module

FAQ

Frequently asked questions about data subject rights

Without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR). In complex cases or with many requests, the deadline can be extended by two months; the person must be informed within the first month, with reasons.
Under Regulation (EEC, Euratom) No 1182/71, which the EDPB refers to: received on 5 March, due on 5 April. If the day does not exist in the following month, the deadline is the last day of that month (31 August → 30 September). If it falls on a weekend or public holiday, the next working day applies.
No. The GDPR prescribes no form. An email, letter or phone call is enough. The controller must facilitate the exercise of rights (Art. 12(2)); it may offer a form but should not insist on it when a request arrives another way.
Only where there are reasonable doubts about identity and only as far as necessary to confirm it (Art. 12(6)). Matching against existing data, such as a customer number or stored email address, is often enough.
No, access and actions under Art. 15–22 are free of charge (Art. 12(5)). A reasonable fee is permitted only for manifestly unfounded or excessive requests and for further copies under Art. 15(3).
Confirmation whether data is processed, a copy of the data and the details under para. 1(a)–(h): purposes, data categories, recipients, retention, rights, right to complain, source and, where relevant, information on automated decisions. For third-country transfers, the safeguards under Art. 46 as well.
When an exception under Art. 17(3) applies – for example a statutory retention obligation under commercial or tax law, or where the data is needed to establish, exercise or defend legal claims. Processing is then restricted instead.
Against direct marketing always, without balancing (Art. 21(2), (3)). Against processing based on Art. 6(1)(e) or (f) where grounds relating to the person's particular situation exist; the controller may then continue only if it demonstrates compelling legitimate grounds or pursues legal claims.
The person can complain to the supervisory authority (Art. 77) and claim compensation (Art. 82). Infringements of Art. 12–22 can be fined under Art. 83(5)(b) with up to EUR 20 million or 4% of worldwide annual turnover.
Yes. If an AI tool stores inputs, histories or outputs relating to a person, they are covered by access, rectification and erasure. For automated decisions under Art. 22, information about the logic belongs in the answer. For Annex III high-risk AI, the right to explanation under Art. 86 AI Act is added – relevant in practice from 2 December 2027, when the high-risk rules for Annex III apply.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

As of · SimpleAct editorial team

This guide is general information and not legal advice. Exceptions are shortened; the legal text is authoritative.

Changes

  • 2026-10-04 – Page rebuilt: rights overview, content of an access response, deadline table, deadline calculator with plan, AI section, limits.
  • 2026-06-13 – First version.

Related topics

No more data subject requests in the wrong inbox

SimpleAct calculates deadlines, sorts cases and builds response packages from your record of processing. Try 7 days (credit card required) or book a demo.

Book a demoTry 7 days (credit card required)