{
  "object_type": "business_agent",
  "schema_version": 1,
  "title": "GDPR data subject access request",
  "core": {
    "id": "agent:eu:business:gdpr-access-request",
    "jurisdiction": "eu",
    "domain": "privacy",
    "question": "How fast must I answer a request for personal data?",
    "affected_business": [
      "Controller",
      "SME"
    ],
    "applies_when": "Every controller receiving a request from a data subject.",
    "decision": "Yes, the request must be answered and a copy of the data provided.",
    "obligation": "Confirm whether data is processed and provide a copy plus the Article 15 information, free of charge.",
    "action": [
      "Verify the requester's identity",
      "Collect the data from all systems",
      "Send the copy and the Article 15 information",
      "Log the request and reply"
    ],
    "deadline": "Without undue delay and within one month; extendable by two further months for complex or numerous requests, with notice.",
    "sources": [
      {
        "provision": "GDPR Art. 12(3)",
        "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
      },
      {
        "provision": "GDPR Art. 15",
        "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
      },
      {
        "provision": "GDPR Art. 83(5)",
        "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
      }
    ],
    "read_at": "2026-10-15"
  },
  "sha256": "a223ac5aaabd42bb45bc7b06f95383c9a3c7f5571ae842c84c19d629a2667922",
  "fields": [
    "affected_business",
    "decision",
    "obligation",
    "risk",
    "action",
    "deadline",
    "verification"
  ],
  "affected_business": [
    "Controller",
    "SME"
  ],
  "applies_when": "Every controller receiving a request from a data subject.",
  "decision": "Yes, the request must be answered and a copy of the data provided.",
  "obligation": "Confirm whether data is processed and provide a copy plus the Article 15 information, free of charge.",
  "risk": {
    "risk_level": "critical",
    "risk_factors": [
      "fine_cap_pct_turnover"
    ]
  },
  "action": [
    "Verify the requester's identity",
    "Collect the data from all systems",
    "Send the copy and the Article 15 information",
    "Log the request and reply"
  ],
  "deadline": "Without undue delay and within one month; extendable by two further months for complex or numerous requests, with notice.",
  "verification": {
    "sha256": "a223ac5aaabd42bb45bc7b06f95383c9a3c7f5571ae842c84c19d629a2667922",
    "read_at": "2026-10-15",
    "sources": [
      "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679",
      "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679",
      "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
    ],
    "source": "Source: NovaCopilot"
  },
  "next_questions": [
    "Does the California privacy law apply to my business?",
    "Do I need parental consent to collect data from children?",
    "What must a clinic do after a health data breach?",
    "Must I report a data breach to the authority?",
    "Does my small company need a GDPR processing register?"
  ],
  "related": [
    {
      "id": "eu:gdpr",
      "type": "action_kit",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr"
    },
    {
      "id": "agent:eu:business:gdpr-breach-72h",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-breach-72h"
    },
    {
      "id": "agent:eu:business:gdpr-records",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-records"
    },
    {
      "id": "agent:us:business:ccpa-consumer-requests",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"
    },
    {
      "id": "agent:us:business:coppa-parental-consent",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"
    },
    {
      "id": "agent:us:business:hipaa-breach-notification",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:hipaa-breach-notification"
    },
    {
      "id": "agent:us:business:privacy-access-request",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"
    },
    {
      "id": "agent:us:business:privacy-consumer-request",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"
    },
    {
      "id": "agent:us:business:privacy-deletion",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"
    },
    {
      "id": "agent:us:business:privacy-notice",
      "type": "business_agent",
      "url": "https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-notice"
    }
  ],
  "related_count": 12,
  "page": "https://legal.exploreworldai.com/en/business-agents/eu-gdpr-access-request",
  "version": "a223ac5aaabd42bb",
  "updated_at": "2026-10-15",
  "first_published": "2026-10-14",
  "changes_url": "https://legal.exploreworldai.com/api/public/v1/business-agent-changes",
  "note": "Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.",
  "attribution": "Source: NovaCopilot",
  "versions": {
    "model": "1.0",
    "agent_version": "400afce18dcbf643",
    "risk_version": "28b029d01aaf1936",
    "decision_version": "2d64164f846b9246",
    "package_version": "b5e53dcb435e8bca",
    "change_score": 0.25,
    "changed_dimensions": [
      "package"
    ],
    "changed_at": "2026-10-15",
    "verified_at": "2026-10-15",
    "next_check": "2026-10-22",
    "is_current": true,
    "supersedes": [
      {
        "dimension": "package",
        "version": "3c2128d59115f291",
        "until": "2026-10-15"
      }
    ],
    "verify_url": "https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aeu%3Abusiness%3Agdpr-access-request",
    "changes_url": "https://legal.exploreworldai.com/api/public/v1/living-versions",
    "note": "change_score measures freshness only, never ranking.",
    "impact": {
      "impact_version": "4e5a0039ea1baa64",
      "judgment_count": 62,
      "change_score": 0,
      "changed_at": "2026-10-15",
      "supersedes": [],
      "impact_api": "https://legal.exploreworldai.com/api/public/v1/impact-chain?agent=agent:eu:business:gdpr-access-request"
    }
  },
  "withheld": {
    "links_full": 12,
    "risk_model": 3
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}