A customer asks what your AI tools hold about them: a GDPR Article 15 access-request sheet for small EU businesses (prompts, chat logs, transcripts, scores)
What you get: a finished access-request sheet to fill once per request: a deadline line, a where-to-search table for six common kinds of AI tool, the eight items Article 15 says you must tell the person, a section for automated scores and decisions, a check for other people's data in transcripts, and a short reply you can adapt.
The short answer
Under Article 15 GDPR, a person can ask whether you process their personal data and, if you do, get a copy of it plus eight pieces of information. Data inside AI tools counts like any other data you control: prompts, uploads, chat logs, transcripts, outputs about them and scores. You must answer without undue delay and within one month (Article 12(3)), and the first copy is free (Article 15(3)).
Step 1: log the request and the deadline
| Line | Fill in |
|---|---|
| Received on | [date] by [email / form / letter / in person]. Any channel counts; no special form is needed. |
| Identity | [confirmed / asked for more information on date]. Ask only if you have reasonable doubts (Article 12(6)), and ask only for what you need. |
| Reply due | [received date + 1 month]. Extension of up to 2 more months only if complex or many requests, told to the person with reasons within the first month (Article 12(3)). |
| Owner | [name]. If you have a DPO, copy them. |
Step 2: search every AI tool
| Tool type | What may hold their data | How to search | Found? |
|---|---|---|---|
| Chat assistant used by staff | Workspace history and shared chats; uploaded files | Search the person's name, email and customer number in workspace history; ask the admin for an export | [found Y/N] |
| Website chatbot | Conversation logs, contact details collected, any tags | Search by email or session; export the conversations with that person | [found Y/N] |
| Meeting note-taker or call AI | Recordings, transcripts, summaries, action items | Search meetings they attended; include passages where they speak or are discussed | [found Y/N] |
| CRM or sales AI | Lead scores, enrichment data, AI-written notes, email drafts | Export the record, the score and the fields the score uses | [found Y/N] |
| CV or applicant screening tool | Parsed CV, ranking, match score, reviewer notes | Export the candidate record and the score with the main factors | [found Y/N] |
| Supplier's own logs | Abuse-monitoring or support logs the supplier keeps for you | Ask the supplier in writing (Article 28(3)(e)) and note the date you asked | [found Y/N] |
Use your list of AI tools so none is missed; the Article 30 records sheet or the SME AI inventory template works as that list. Keep a note of what you searched and when.
Step 3: the eight items you must tell them (Article 15(1))
| 15(1) | Item | For AI tools, write | Done |
|---|---|---|---|
| (a) | Purposes | Why each AI tool processes their data (for example: answering support chats, meeting notes, lead scoring) | [filled] |
| (b) | Categories of data | For example: name, email, chat content, voice recording, score | [filled] |
| (c) | Recipients | The AI supplier and its sub-processors, especially any outside the EU | [filled] |
| (d) | Storage period | How long each tool keeps it, or the criteria used to decide | [filled] |
| (e) | Their other rights | Rectification, erasure, restriction, objection | [filled] |
| (f) | Right to complain | To a data protection authority | [filled] |
| (g) | Source | Where data you did not collect from them came from (for example enrichment or scraping) | [filled] |
| (h) | Automated decisions | Whether Article 22 decision-making, including profiling, is used and, if so, meaningful information about the logic involved and the significance and envisaged consequences for them | [filled] |
Where data goes to a country outside the EU, also tell them the safeguards used for that transfer (Article 15(2)), for example standard contractual clauses.
Step 4: scores and automated decisions
A score or label about the person is their personal data, so include it in the copy. If the tool makes or nearly makes a decision with legal or similarly significant effect, item (h) applies. In case C-203/22 (Dun & Bradstreet Austria, 27 February 2025) the Court of Justice said the explanation must describe the procedure and principles actually applied, in a way the person can understand, so they can see which of their data was used and how. If you believe trade secrets are involved, you cannot simply refuse; the Court said the information must then go to the authority or court, which weighs the interests. Ask your supplier now for a plain-language description of how its score works. See the Article 22 decision sheet.
Step 5: other people in the data
Transcripts and chat logs often contain other people. The right to a copy must not adversely affect the rights and freedoms of others (Article 15(4)). Remove or mask other people's details where giving them would harm those people, but do not withhold the person's own data for that reason. The Court of Justice held in case C-487/21 (4 May 2023) that the copy must be a faithful and intelligible reproduction of the data, which can mean extracts of documents or whole documents where that is needed to understand them.
Step 6: send the reply
[Name], thank you for your request of [date]. We process the personal data listed below, including data held in the AI tools we use. Attached is a copy. For each tool: purpose [..], data [..], recipients [supplier and its sub-processors], storage period [..], source [..]. We [do / do not] use automated decision-making within the meaning of Article 22 GDPR [if yes: how it works and what it means for you: ..]. You can ask us to correct or delete your data, restrict or object to its use, and you can complain to [authority]. [Your name, business]
Do this week
- Make sure every AI tool is on your tool list, with an admin who can search and export
- For each supplier, find out how to export one person's data and how long logs are kept
- Ask each scoring or screening supplier for a plain-language explanation of its logic
- Save this sheet as your template and diary the one-month deadline on every new request
This sheet is a working aid, not a legal opinion or proof of compliance. GDPR references are to Regulation (EU) 2016/679 (Articles 12, 15, 22 and 28). Judgments referred to: C-487/21 (4 May 2023), C-307/22 (26 October 2023) and C-203/22 (27 February 2025) of the Court of Justice of the EU. For detail, see the EDPB Guidelines 01/2022 on the right of access. Checked on 21 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients usually find out where their AI tools keep customer data only when the first access request arrives. At the next review, run Step 2 with them for each tool and keep the filled table with their client AI inventory. Stay inside your professional rules and pass complex requests to a privacy professional or lawyer.
Keep the sheet next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once with the admin who can export its data, so Step 2 takes minutes.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then keep this sheet ready. Related: DPIA screening sheet · Article 30 records sheet · meeting note-taker setup sheet · AI supplier contract clauses.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 12, 15, 22, 28
- EDPB Guidelines 01/2022 on data subject rights: right of access
- Court of Justice, case C-487/21
- Court of Justice, case C-307/22
- Court of Justice, case C-203/22
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.