Right to Access (Subject Access Request)
An individual's right to obtain a copy of their personal data and information about how it is processed.
The right of access (GDPR Article 15) allows individuals to obtain confirmation of whether their personal data is being processed and, if so, access to that data along with information about: the purposes of processing, categories of data concerned, recipients, retention periods, the source of the data, and the existence of automated decision-making. Organizations must respond within one month (extendable by two months for complex requests). The first copy must be provided free of charge. This is also known as a Subject Access Request (SAR). Under CCPA, the 'right to know' serves a similar function, requiring businesses to disclose what personal information they collect, use, share, and sell.