DPA Subject Access Request Template for Germany

When you receive a subject access request from an individual in Germany, you must respond with comprehensive information about how you process their personal data. This response is not optional—it's a fundamental right under Article 15 of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz or BDSG). Your response must be clear, complete, and provided free of charge within one month of receiving the request.

When do you need this document?

You need a DPA Subject Access Request response whenever an individual formally requests information about their personal data that your organization processes. This includes employees asking about their HR records, customers inquiring about their purchase history and account data, website users requesting details about cookies and tracking, or anyone whose personal information you collect, store, or process. The request can come via email, letter, phone call, or through your website, and you must respond regardless of the communication method used. Even if you believe you don't hold any data about the person, you must still provide a formal response confirming this.

Key legal considerations

Your response must include specific information mandated by Article 15 GDPR: confirmation of whether you process their data, the categories of personal data involved, the purposes of processing, recipients or categories of recipients, retention periods, and information about their rights to rectification, erasure, or restriction of processing. You must also disclose the source of the data if not collected directly from the individual, details about any automated decision-making including profiling, and information about international transfers including appropriate safeguards. If you cannot fulfill the request, you must explain why and inform the individual of their right to complain to a supervisory authority. Failure to respond adequately can result in fines up to 4% of annual global turnover or €20 million under GDPR Article 83.

Legal requirements in Germany

Under German law, the BDSG supplements GDPR requirements with additional national provisions. You must verify the requester's identity before disclosing personal data, particularly when the request involves sensitive information or could affect third parties. The German Data Protection Authority (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit) expects responses to be provided in German unless the individual specifically requests another language. If your organization employs a Data Protection Officer (DPO), their contact details must be included in your response. For complex requests involving large amounts of data, German courts have accepted that providing summaries or allowing inspection of records may be sufficient, but this must be justified and the individual must be informed of alternative access methods. You must also consider German civil law principles when handling requests that could reveal information about third parties, balancing transparency rights with privacy protection.