Any person whose data you process can ask you what you hold about them, and you must answer within one month (Art. 15, Art. 12(3) GDPR). The right applies to customers, former customers, employees, applicants and website visitors in the EU alike, and it is used tactically, in disputes with former employees, in consumer complaints and by people who simply want to know. An incomplete or late answer leads to complaints to the supervisory authority and increasingly to damage claims under Art. 82 GDPR. We prepare the complete answer for a fixed fee of 150 EUR.
What the fixed fee covers
We review the request and tell you whether it is valid and whether the identity of the requester needs to be verified. We tell you which data has to be disclosed, which may be withheld to protect third parties or trade secrets, and in which form the copy must be provided. We draft the response letter in English or German with all information required by Art. 15(1) GDPR, from the purposes and recipients to the storage period and the right to lodge a complaint, and the cover note for the copy of the data. If the request is manifestly unfounded or excessive, we draft the refusal with the reasons the law requires.
What you contribute
You collect the data concerning the requester from your systems, which only you can do, and send it to us. We tell you where to look, typically the customer database, the email system, the ticketing tool, the shop or app backend and the marketing tools. The one-month deadline runs from receipt of the request, so please send us the request as soon as it arrives.
Recurring requests
If you receive access requests regularly, we set up a template and a procedure for your team so that routine requests can be answered in-house and only the difficult ones reach us. This is included in the external data protection officer mandate and can be quoted separately.
Prices are net attorney fees. For business clients outside Germany no German VAT is added.
How to instruct us
Send us the details through the form below. You will receive our confirmation and, where required, our questions in English within one working day. We correspond in English throughout the mandate.
The German-language description of this offer, written for clients in Germany, Austria and Switzerland, is available at DSGVO-Auskunft erteilen. Please note that this link takes you to our German website matutis.de. You do not have to use it, everything you need to instruct us for the data subject access request is on this page, and you are welcome to write to us in English at any time.