The legal briefPersonal data · right of access
Subject access request in France: what you can obtain, the time limit to answer and the remedies
For an ordinary GDPR request, the organisation confirms processing and provides a free copy, subject to excessive requests and others’ rights (articles 12 and 15; French Data Protection Act, article 49). An answer is due within one month, extendable by two months where necessary for complexity or request volume, with reasons notified in the first month. Employees can access work emails (Cour de cassation, 18 June 2025).
Go to the tool: the legal brief
Julie by AlphaDeep is an AI legal assistant for French law: it researches official references to help answer your questions (Légifrance, case law, service-public), analyses your documents and drafts your letters, for individuals and professionals alike.
General legal information with official references and dated checks. It is not personalised advice: for a decision that commits you, have your situation checked by a qualified professional.
Let’s look at your situation
Name the organisation, the date of your request, what you asked for and the answer received.
Example questions
Your question carries over after signup. Maximum 400 characters. Avoid health data and names.
When must the organisation answer you?
Check the ordinary regime and national calendar, then say who you are and when the request allowing your identification was received, any extension announced and the answer obtained: the brief ends with its reasons. The example: an employee whose request was received on 7 September 2026, with no answer.
Fictional example · brief on your request
Without an answer by the deadline, a complaint to the CNIL is open.
- Answer due at the latest
- 7 October 2026
- Extension
- none
For these reasons
In view of your answers, the GDPR and the CNIL’s recommendations:
- Time limit: an answer by 7 October 2026 at the latest, one month after your request was received (GDPR, article 12.3).
- Employee: your work emails are personal data; the employer must provide their metadata and content, unless this harms the rights of others (Cour de cassation, 18 June 2025, no. 23-19.022).
- Without an answer by 7 October 2026, complain to the CNIL with proof of your request; restriction depends on article 18 conditions, such as disputed accuracy or data needed for legal claims. Access delay alone is insufficient.
- Free of charge: the first copy is free; reasonable fees only apply to further copies or a manifestly unfounded or excessive request (GDPR, article 12.5).
Ordinary GDPR regime only. Mainland national calendar: Saturday, Sunday or public-holiday expiry moves to the next working day (Regulation 1182/71, articles 2 and 3). Identification and reasons remain to be assessed; the CNIL assesses a complaint on the evidence of your steps.
What can you obtain with a subject access request?
The right of access is exercised under article 15 of the GDPR (French Data Protection Act, loi Informatique et Libertés, article 49): the organisation confirms whether it processes data about you and gives you a copy, in an understandable form.
Restricted police or State-security registers, medical-file access and article 49 exceptions follow special rules: the ordinary calculation below does not cover them. You do not have to give a reason for your request, and you can make it alongside a dispute, before the labour court (conseil de prud’hommes) for example, subject to the rights of third parties (CNIL).
Sources: Data Protection Act, art. 49 · CNIL, right of access · CNIL, employees
How long does the organisation have to answer?
Without undue delay and at the latest one month after receiving the request; this can be extended to three months given the complexity or number of requests, provided you are told, with the reasons, within the first month (GDPR, article 12.3; CNIL).
Without an answer or an extension announced within that month, you can prepare a CNIL complaint with its evidence, with proof of your request; restriction of processing depends on the conditions in article 18, for example disputed accuracy or data needed for legal claims. A late access response alone does not establish a right to this freeze.
Sources: CNIL, answering a request · CNIL, right of access · CNIL, complaint · CNIL, article 18 · GDPR 12, 15 and 18 · Regulation 1182/71 · C. trav. L3133-1
Do you have to pay or prove your identity?
The copy is free: reasonable fees based on administrative costs can only be charged for a further copy or a manifestly unfounded or excessive request (GDPR, article 12.5; CNIL).
Identity can be shown by any means: the organisation can only demand a copy of an identity document if it has reasonable doubt (CNIL).
Source: CNIL, answering a request
Can an employee obtain their work emails?
Yes: emails sent or received by the employee with their work mailbox are personal data, and the employer must provide their metadata, time stamps and recipients, and their content, unless this harms the rights and freedoms of others (Cour de cassation, social chamber, 18 June 2025, no. 23-19.022).
In that case, the employer that had only sent various documents, without the emails or any reason, was at fault and had to compensate the harm. The CNIL also accepts access to the data in the administrative or human-resources file.
Sources: Cass. soc. 18 June 2025 · CNIL, employees
What must the organisation’s answer contain?
Besides the copy of your data, the information in article 15 of the GDPR, in the order of the CNIL’s list.
The purposes
What your data is used for, that is, the purposes of the processing.
The categories of data
For example your name, first name or address.
The recipients
Their identity, or their categories if they cannot be identified, especially outside the European Union.
The retention period
Or, failing that, the criteria that set it.
Your other rights
Rectification, erasure, restriction, objection, and the possibility of complaining to the CNIL.
The source
Where your data came from, if it was not collected from you.
Automated decisions
Whether there are any, including profiling, the logic involved, and their significance and envisaged consequences for you.
Transfers outside the European Union
For transfer to a third country or international organisation, the appropriate safeguards under GDPR article 46.
What changed for employees in 2025?
The CNIL’s fiche and a ruling of the social chamber on access to work emails.
The CNIL updates its fiche on employees’ right of access: it covers the data in the administrative or human-resources file and the data in work emails, while respecting the rights of third parties.
Source: CNIL, employees
The Cour de cassation holds that work emails sent or received by the employee are personal data and that the employer must provide their metadata and content, unless this harms the rights of others (no. 23-19.022).
Source: Cass. soc. 18 June 2025
What does article 49 of the French Data Protection Act say?
The French text that refers to article 15 of the GDPR and lets the court protect data at risk.
Le droit d’accès de la personne concernée s’exerce dans les conditions prévues à l’article 15 du règlement (UE) 2016/679 du 27 avril 2016. En cas de risque de dissimulation ou de disparition des données à caractère personnel, le juge compétent peut ordonner, y compris en référé, toutes mesures de nature à éviter cette dissimulation ou cette disparition.
In English, briefly (our summary, not an official translation): The data subject’s right of access is exercised under article 15 of Regulation (EU) 2016/679 of 27 April 2016. Where personal data risk being concealed or lost, the competent court can order, including in summary proceedings (référé), any measure to prevent this. Article 15 of the GDPR sets the content of the right; its article 12 sets the one-month time limit, the extension and the free copy.
What do people exercising their right of access ask?
How should you word the request?
By online form, email or letter to the organisation or its data protection officer; the CNIL offers a model letter. Keep a copy of the request and proof of sending, useful for a complaint.
Can the organisation refuse?
Only by giving reasons and stating the remedies and time limits, for example for a manifestly unfounded or excessive request because it is repetitive, or if the data is no longer kept (CNIL).
The answer is incomplete: what now?
The CNIL recommends first asking the organisation to complete its answer with the missing data; failing a satisfying answer, complain to the CNIL with evidence of your steps.
Can the CNIL act on your behalf?
No: it cannot exercise your rights if you have not, nor obtain damages for you. On a complete and precise complaint, it investigates and, if breaches are proven, can issue a reminder, a formal notice or a financial penalty.
What if your data risks disappearing?
The court can order, even in summary proceedings, any measure to prevent it being concealed or lost (French Data Protection Act, article 49).
Which texts and fiches is this brief based on?
- Loi n° 78-17 of 6 January 1978, article 49 (right of access)Légifrance, in French
- The right of access: knowing what data an organisation holds on youCNIL, in French
- Professionals: how to answer a right of access requestCNIL, in French
- Employees’ right of access to their data and work emailsCNIL, in French · updated on 31 January 2025
- Cour de cassation, social chamber, 18 June 2025, no. 23-19.022Légifrance, in French
- Filing a complaint with the CNILCNIL, in French
- Model letter: exercising your right of accessCNIL, in French
- GDPR, articles 12, 15 and 18 (complete official French text)Publications Office of the European Union, in French
- Regulation 1182/71, articles 2 and 3 (time limits and working days)Publications Office of the European Union, in French
- Labour Code, article L3133-1 (national public holidays)Légifrance, in French
- CNIL: conditions for restriction of processingCNIL
Texts cited last checked: 26 September 2026