The right of access is a GDPR data subject right under Article 15 allowing individuals to request a copy of the personal data an organization holds about them. The response — a Subject Access Request (SAR) — must be provided within one month, free of charge. It must include: what data is held, why it is processed, who it is shared with, how long it will be retained, and what rights the individual can exercise. Organizations cannot charge for the first request unless it is manifestly unfounded or excessive. Cookie consent records and behavioral tracking data may be included in SAR responses.