The right of access is the most important data subject right, because all others build on it: without knowing which data is processed, nobody can request rectification or erasure.
Content under the FADP
Under Art. 25 FADP the data subject receives the information needed to assert their rights. This includes the controller’s identity and contact details, the personal data processed as such, the purpose, the retention period or criteria for it, available information on the source of the data, any automated individual decision and the recipients, including countries in case of transfers abroad.
Deadlines and fees
The Data Protection Ordinance requires access to be provided within 30 days; if this cannot be met, the person must be informed. Access is generally free. A reasonable contribution of no more than CHF 300 is permitted only if providing access involves disproportionate effort, and the person must be informed in advance. Under the GDPR the deadline is one month, extendable by two months in justified cases.
Restrictions
Access may be refused, restricted or deferred if a law provides for it, overriding third-party interests prevail or the request is manifestly unfounded or vexatious. Private controllers may also invoke overriding own interests if they do not disclose the data to third parties. Every restriction must be justified.
Practice
The biggest difficulty is not the legal question but finding the data across all systems. A fixed process with a data map answers requests in days rather than weeks. The steps are in our access request checklist; automation is described in the offer automating access requests.