Data subject access request under Article 15 GDPR (Germany)
Published byDocMuse
This document is in German
The PDF you download is in German — that is the language it has to be filed in, so it is not translated. Everything on this page is here to tell you what it says.
Your request to a company, club or other body in Germany that processes data about you: under Article 15 of the GDPR (DSGVO in German) you ask what data it holds, why, who receives it, how long it keeps it and where it came from, and for a copy of the data — the first copy free. The answer is due within one month (Article 12(3)). If none comes, you can complain to the data protection authority of your German state. For customer, member and user accounts. In German.
What you fill in
The details the document asks for.
- Applicant
- Applicant's address
- Data controller
- Controller's postal address (from its privacy notice)
- City
- Date
- Client number
- Date of birth
Preview
This document is produced for you. Your answers are typed into it and the finished PDF is yours to keep.
Common questions
- How long may a company in Germany take to answer an access request, and what does it cost?
- The answer is due without undue delay and at the latest within one month of receiving the request; for complex or numerous requests that can be extended by two months, which must be explained to you within the first month (Article 12(3) GDPR). The first copy of your data is free, whatever you need it for (Article 15(3) GDPR; Court of Justice of the EU, C-307/22).
- Where do I complain in Germany if no answer, or an incomplete one, arrives?
- To a data protection supervisory authority (Article 77 GDPR). In Germany each state has its own authority for companies and associations; for telecoms and postal companies the Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible. A complaint costs nothing. Enclose your request, proof that it arrived and any reply.
- Must a German access request give reasons or be signed, and is an email enough?
- No reasons are needed and no particular form is required: an email to the address given in the privacy notice is enough, and so is a signed letter. Keep proof of receipt, since the one-month period runs from it. The company may ask for further proof of identity only if it has reasonable doubts (Article 12(6) GDPR); a copy of your ID card is rarely needed.
How you can sign this document
- Print it and sign by hand. The signature lines in the document are left blank on purpose — sign on them in ink.
- Sign it yourself with a qualified electronic signature. If you already hold a QES — Evrotrust, B-Trust, StampIT, ZealiD or any qualified provider on the EU Trusted List, on a card, a USB token, in a mobile app or in the cloud — our signing guide explains step by step how to sign this exact file without invalidating it. Step-by-step help, and a way to check it worked
DocMuse sells documents, not legal advice. Acceptance always depends on the recipient's rules and your local law.
Related documents
- Objection to data transfers from the population register (Germany)
The informal letter to the German registration office (Meldebehörde) that has transfer blocks entered in the population register: you object, point by point, to your data being passed to political parties before elections, to office-holders and the press for birthday and wedding anniversaries, to address-book publishers (§ 50(5) of the Federal Registration Act, BMG) and to a family member's religious community (§ 42(3) BMG). It leaves out the objection to transfers to the Bundeswehr, abolished on 1 January 2026. Many offices also offer their own free form. In German.
- Data processing agreement under Art. 28 GDPR (Germany)
The data processing agreement (Auftragsverarbeitungsvertrag, AVV) every business in Germany needs when a service provider processes personal data for it — hosting, cloud software, payroll, newsletters, IT support. It contains everything Art. 28(3) GDPR requires: subject-matter, duration, nature and purpose, types of data and data subjects, instructions, confidentiality, security, sub-processors, assistance, deletion or return, information and audits, with annexes for the technical and organisational measures and the sub-processors. Free models from supervisory authorities and the European Commission also exist. In German.