Every entry links the published document it was written from, the judgment or the decision itself and never a report about it. An entry about a named organisation says only what that published document says: there is no speculation here about a fine, a company or a person, and no individual data subject is named even where a decision names one. This is a record of what was decided, not news and not commentary.
Reference / The Signal11 entries · Updated 19 Sep 2026
The Signal
What changed, and what it changes at the desk.
The Signal is the case law and the supervisory authority decisions on data subject access requests, one entry per published document. A record of the rulings, guidelines and decisions that move how an access request is answered. Each entry says what happened, links the document it was written from, and says in one paragraph what a practitioner does differently once it exists.
The record
How this record works
The only party left holding the data was the controller, whatever its contract said
16 Jan 2026DecisionNorwayReviewed 15 Sep 2026
Read the entryA fine where a supplier refused access to time records after its customer went bankrupt, on the view that it was a processor with no controller left to instruct it.
A form for every register, and an identity document, were both too much
2 Apr 2025DecisionFinlandReviewed 15 Sep 2026
Read the entryA controller may offer a request form and may not require one, and it may not ask for more identifying data than it can check the requester against.
The first copy is free, whatever the requester wants it for
26 Oct 2023RulingEuropean UnionReviewed 15 Sep 2026
Read the entryA controller must provide a first copy free of charge even where the reason for the request is not one of the reasons recital 63 gives.
A copy is only as complete as the systems that were searched
29 Jun 2023DecisionSwedenReviewed 15 Sep 2026
Read the entryA reprimand and an order where the extract missed a mailbox nobody searched, a case system searched in the wrong case, and travel history searched on the wrong identifiers.
Consultation logs are disclosable, the names inside them usually are not
22 Jun 2023RulingEuropean UnionReviewed 15 Sep 2026
Read the entryAccess covers information about consultation operations on the data, but not the identity of the employees who carried them out unless that is essential to the requester's rights.
A copy means the data faithfully, and sometimes the document around it
4 May 2023RulingEuropean UnionReviewed 15 Sep 2026
Read the entryA summary of categories is not a copy, and extracts or whole documents must be given where they are essential for the data to be intelligible.
The Board's adopted reading of the right of access
28 Mar 2023GuidelineEuropean UnionReviewed 15 Sep 2026
Read the entryThe adopted guidelines on Article 15: no reasons required, no mandatory form, a bare request means everything, and identity checks proportionate to the data at stake.
A copy withheld in full because it concerned other people too
29 Nov 2022DecisionDenmarkReviewed 15 Sep 2026
Read the entrySerious criticism and an order: an exemption from the right of access is assessed item by item, so the parts it does not reach are still disclosed.
An identity number collected out of habit, and an answer five months late
16 Feb 2022DecisionDenmarkReviewed 15 Sep 2026
Read the entrySerious criticism where a national identity number was taken with no purpose and no basis, and the access request that followed was answered late and incompletely.
The month runs from the request, not from the right inbox
31 Mar 2021DecisionSwedenReviewed 15 Sep 2026
Read the entryA reprimand where a request sent to an address other than the designated one fell outside the internal routine and was answered more than five months later.
A request for everything covers the camera footage too
18 Nov 2019DecisionDenmarkReviewed 15 Sep 2026
Read the entrySerious criticism where the answer listed the categories held without handing over their content, and footage was deleted because the request had not named it.