You have a right to ask for and obtain from the company/organisation confirmation as to whether or not it holds any personal data which concerns you.
If they do have your personal data then you have the right to access that data, be provided with a copy and get any relevant additional information (such as their reason for processing your personal data, the categories of personal data used, etc.).
This right of access should be easy and be made possible at reasonable intervals. The company/organisation should provide a copy of your personal data free of charge. Any further copies may be subject to a reasonable fee. When the request is made by electronic means (for example through an e-mail), and unless otherwise requested by you, the information should be provided in a commonly used electronic form.
This right is not absolute: the use of the right to access your personal data should not affect the rights and freedoms of others, including trade secrets or intellectual property.
Right to access
You borrow books from a library. You can ask the library to provide you with the personal data which concerns you that they hold. The library should then provide you with all information about you that is stored by them. For example, when you first started using the library services, which books you have borrowed; whether you have ever had any book overdue and fines you might have incurred.
You subscribed to a loyalty card scheme of a supermarket chain located in different parts of the city and throughout the country. If you use your right to ask for information about and obtain your personal information stored by the loyalty card scheme, you should receive information about, for example, how often you used the card, at which supermarkets you did your shopping, any discounts you were awarded and whether you were targeted through the use of profiling techniques, and in which way, whether the supermarket, which is part of a multinational chain of companies, has disclosed your data to its sister company selling perfumes and cosmetics.
- Article 15 and Recitals 63, 64 of the GDPR