What is Right to Access (Right to Know)?

Access is the gateway right: without seeing what an organization holds, an individual cannot meaningfully correct, delete, or object. Under GDPR Article 15, the response must include not just a copy of the personal data but its context — purposes of processing, categories of data, recipients or categories of recipients (including third countries), retention periods or criteria, the existence of other rights, the data's source if not collected directly, and the existence and logic of any automated decision-making.

The CCPA's right to know parallels this: consumers may request the categories of personal information collected, the sources, the business or commercial purposes, the categories of third parties it is disclosed to, and the specific pieces of personal information — generally covering the preceding 12 months, delivered within 45 days. The CCPA also grants portability by requiring the data in a usable, transferable format; GDPR splits portability into its own right (Article 20) covering machine-readable transfer of data the individual provided.

Two operational tensions define access handling. Verification versus friction: releasing a person's full profile to an impostor is itself a breach, so identity must be confirmed proportionately to sensitivity — but demanding excessive proof unlawfully obstructs the right. Completeness versus third parties: the response must cover data across all systems, yet redact other individuals' personal data and protect trade secrets, without using those carve-outs to withhold the requester's own information.

Access responses are also discovery: plaintiffs' counsel and regulators use them to map an organization's data practices, so inconsistencies between the access response, the privacy policy, and reality are themselves evidence.