1. Any person who requests information from the controller as to whether personal data relating to him or her are being processed must do so in writing. If the controller agrees, the request may also be made verbally.
2. The information shall be provided in writing or in the form in which the data is available. By agreement with the controller, the data subject may inspect his or her data on site. The information may be provided verbally if the data subject agrees.
3. Information may be requested and provided electronically.
4. The information must be given to the data subject in a comprehensible form.
5. The controller must take appropriate measures to identify the data subject. The data subject is obliged to cooperate in the identification process.

1. Where two or more controllers are processing personal data jointly, the data subject may exercise his or her right of access in relation to any one of them.
2. If the request relates to data that is being processed by one processor, the processor shall assist the controller in providing the information where it does not answer the request on behalf of the controller.

1. The information must be provided within 30 days of receipt of the request.
2. If it is not possible to provide the information within 30 days, the controller must notify the data subject of this and of how long it will take to provide the information.
3. If the controller decides to refuse, restrict or defer the right of access, it must notify the data subject of this within the same deadline.

1. If providing the information involves a disproportionate cost, the controller may require the data subject to contribute to the costs in an appropriate manner.
2. The contribution may not exceed 300 francs.
3. The controller must notify the data subject of the amount of the contribution before providing the information. If the data subject does not confirm the request within ten days, the request is deemed to have been withdrawn with no costs incurred. The period referred to in Article 18 paragraph 1 shall begin on expiry of the ten-day reflection period.

1. Personal data that the data subject has disclosed to the controller are:
   • a. data that the data subject has knowingly and voluntarily made available;
   • b. data that the controller has obtained relating to the data subject and his or her behaviour while the data subject was using a service or device.
2. Personal data that the controller has itself generated from its own evaluation of the personal data provided or observed are not deemed to be personal data that the data subject has disclosed to the controller.

1. A conventional electronic format is any format that allows the personal data to be transmitted and reused by the data subject or another controller at a proportionate cost.
2. The right to data portability does not create any requirement for the data controller to adopt or maintain technically compatible data processing systems.
3. The cost of transferring personal data to another controller is disproportionate if the transfer is technically impossible.

Articles 16 paragraphs 1 and 5 and 17–19 apply mutatis mutandis to the right to data portability.