Article 12 of the data Protection Directive provides that the data subjects have a right of access. [1]
Several DPAs have made available forms to exercise this right.
For example:
– Italian Data Protection Authority (Garante)’s:MODELLO esercizio diritti in materia di protezione dei dati personali
– Uk Data Protection Authority (ICO)’s: ICO_how_to_make_a_request
– Spanish Data Protection Authority (Agency): derecho de acceso
– French Data Protection Authority (CNIL): see here
=========
[1] Article 12
Right of access
Member States shall guarantee every data subject the right to obtain from the controller:
(a) without constraint at reasonable intervals and without excessive delay or expense:
– confirmation as to whether or not data relating to him are being processed and information at least as to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed,
– communication to him in an intelligible form of the data undergoing processing and of any available information as to their source,
– knowledge of the logic involved in any automatic processing of data concerning him at least in the case of the automated decisions referred to in Article 15 (1);
(b) as appropriate the rectification, erasure or blocking of data the processing of which does not comply with the provisions of this Directive, in particular because of the incomplete or inaccurate nature of the data;
(c) notification to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out in compliance with (b), unless this proves impossible or involves a disproportionate effort.