What deadline applies?
Under the FADP, access is generally provided within 30 days (Art. 25 para. 7 FADP). If this is not possible, the organisation must notify the data subject and tell them by when the information will be provided (Art. 18 of the Data Protection Ordinance, DPO).
Under the GDPR, access must be provided without undue delay and at the latest within one month. The deadline can be extended by a further two months if the complexity or number of requests makes this necessary; the person must be informed of this within the first month, with reasons (Art. 12 para. 3 GDPR).
What must the response contain?
Both laws require more than a list of data:
| Content | FADP (Art. 25 para. 2) | GDPR (Art. 15) |
|---|---|---|
| The personal data processed as such | yes | yes, as a copy |
| Purpose of processing | yes | yes |
| Retention period or criteria for it | yes | yes |
| Source, if not collected from the person | yes, where available | yes, where available |
| Recipients or categories of recipients | if applicable | yes |
| Automated individual decision and its logic | if applicable | if applicable |
| Identity and contact details of the controller | yes | – |
| Information on further rights and the right to lodge a complaint | – | yes |
How do you verify identity?
Only the entitled person receives the information. Anyone who discloses the data to the wrong person causes a data breach themselves. The check should be appropriate: a copy of an ID document, a login via an existing customer account or video identification – depending on how sensitive the data is.
Why is completeness so difficult?
A person's data is spread across many applications, storage locations and mailboxes. Some systems can be queried directly; for others, the system owners have to check. Meanwhile, the clock is ticking, and in the end it must be traceable who supplied what.
A proven approach is to define once which systems are part of an access request, who is responsible for them and which details the response contains. Then every request is handled the same way, deadlines are monitored and every step is recorded.
When may access be restricted?
The FADP allows access to be refused, restricted or deferred, for example if a law provides for this, if overriding interests of third parties require it or if the request is manifestly unfounded or vexatious (Art. 26 FADP). The reasons must be communicated to the person. The GDPR has similar limits for manifestly unfounded or excessive requests (Art. 12 para. 5 GDPR).