Under Article 15 of the GDPR, you have the right to obtain the following from the data controller:
1. Confirmation of whether or not personal data concerning you is being processed
2. Where personal data concerning you is being processed, a copy of your personal information
3. Where personal data concerning you is being processed, other additional information as follows:
The GDPR states that the right to obtain a copy of your personal data must not adversely affect the rights and freedoms of others. This means that the right cannot be used to access the personal data of other persons, i.e. third parties.
There are also a number of other restrictions to the right of access, provided for by section 60 of the Data Protection Act 2018.
How can I make a request under the Right to Access my personal data?
While the GDPR does not specify any particular format in which you should make an access request, the DPC has provided the below template for access requests that are made to the Data Controller in writing:
I wish to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of any information you keep about me, on computer or in manual form in relation to...
Be as specific as possible in relation to the personal data you wish to access. You may be asked to provide evidence of your identity. This is to make sure that personal information is not given to the wrong person. Further information on how long it will take, how much it will cost, how the information will be provided, and how to raise a concern with the DPC if you are unhappy with the outcome is available on the website of the Data Protection Commissioner.
From: Data Protection Commissioner website