How to answer a request for access to personal data, and within what time?
By Advisorn · updated on 17 October 2026 · Art. 25-26 FADP, Art. 16-19 Data Protection Ordinance, Art. 12 and 15 GDPR
In short
Anyone may ask a business whether it processes data about them and receive a copy, with the purpose, the retention period, the recipients and the States abroad (Art. 25 FADP). The answer must as a rule be given within 30 days and free of charge (Art. 18-19 Data Protection Ordinance); under the GDPR the deadline is one month (Art. 12 and 15 GDPR).
The steps
- verify the identity of the person asking, with proportionate means;
- look for their data in every activity of the record and at the vendors;
- answer with the data and the information of Art. 25 para. 2 FADP, usually in writing;
- if more than 30 days are needed, say so within the deadline and state when you will answer.
When it can be restricted
Access may be refused, restricted or deferred if a law provides for it, if the request is manifestly unfounded or querulous, or because of overriding interests of third parties or of the business (Art. 26 FADP). A contribution to costs of up to CHF 300 is allowed only if answering requires disproportionate effort, and it must be announced beforehand (Art. 19 Data Protection Ordinance).
Related questions
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.