Right of access: confirm processing and hand over data

Under Article 15 of the GDPR, the right of access gives individuals two concrete things: first, confirmation that their personal data is being processed at all, and second, a copy of that data along with key details like the purposes of processing, the categories of data involved, and who it has been shared with. This is not the same as the right to erasure (Article 17), which lets people ask for deletion, or the right to restriction (Article 18), which pauses processing. Think of access as a transparency tool: it reveals what is happening, rather than stopping or deleting it.

A useful trick to avoid confusion is to remember the phrase 'show me, don't stop me' for the right of access. If a question mentions a person wanting to know who their data was sent to or why it is being kept for five years, that is access, not erasure. Another elimination hint: the right of access always comes with a copy of the data, whereas erasure and restriction do not. In multiple-choice questions, watch for distractors that swap the word 'confirmation' for 'deletion' or 'blocking'—those belong to different articles.

To lock this in, test yourself with a quick mental scenario: a customer asks 'Can you tell me if you store my email and who you share it with?' That is access, not erasure. If you can pair the phrase 'confirm and copy' with Article 15, you will dodge the common trap of mixing up these rights.