A resident emails a city portal: 'Send me everything you have on me.' Which response best reflects the GDPR right of access?
Select an answer to reveal the explanation.
Short Explanation
When someone asks 'what do you have on me?', that's the access right knocking. Verify who's asking, then share their data and the main processing story—not a shrug or a 'sue us first.' Limits exist, but silence isn't the default.
Full Explanation
Article 15 grants data subjects the right to obtain confirmation of processing, access to their personal data, and specified information about purposes, recipients, retention, and rights. Controllers should verify identity, respond within statutory timeframes, and apply only recognised restrictions—not ignore portal requests or demand litigation as a precondition.