A controller’s access-request response discloses the personal data but omits recipients or categories of recipients. What Article 15 element is missing?
Select an answer to reveal the explanation.
Short Explanation
Access is not just a data dump of fields—it is also the story of who else got a copy. Recipients or categories of recipients belong in that story. Leaving them out short-changes the transparency Article 15 expects.
Full Explanation
Article 15 entitles the data subject to obtain confirmation of processing and access to the personal data together with specified information, including the purposes of processing, categories of data, and the recipients or categories of recipients. Omitting recipient information when it applies leaves the access response incomplete relative to those mandatory elements.