{"id":21839,"date":"2026-05-28T09:45:18","date_gmt":"2026-05-28T07:45:18","guid":{"rendered":"https:\/\/apdp.mc\/?page_id=21839"},"modified":"2026-07-07T14:30:30","modified_gmt":"2026-07-07T12:30:30","slug":"request-for-access-rights","status":"publish","type":"page","link":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/","title":{"rendered":"Request for access rights"},"content":{"rendered":"<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>As an online shop, can I ask a customer who wishes to exercise their right of access for a copy of their ID?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\">Yes, but <strong>only<\/strong> when there are no other ways to identify the customer. <u>A copy of an ID document should only be requested as a last resort<\/u>.<\/p>\n<p style=\"text-align: justify;\">The data controller must not request more personal data than is necessary to authenticate the person making the request. They must not make the right of access conditional on the provision of supporting documents that are disproportionate or irrelevant to the request.<\/p>\n<p style=\"text-align: justify;\">A customer can generally identify themselves easily by providing their customer number or contract subscription number, or by logging into their customer account if they have created one, or by answering (non-intrusive) security questions to which only they know the answers.<\/p>\n<p style=\"text-align: justify;\">If necessary, the data controller may use multi-factor authentication set up when the customer registered their account, or other existing means of communication known to belong to that customer (such as an email address or telephone number) in order to send them a one-time code.<\/p>\n<p style=\"text-align: justify;\"><strong>To learn more<\/strong>:<\/p>\n<ul style=\"text-align: justify;\">\n<li>Factsheet <a href=\"https:\/\/apdp.mc\/en\/apdp\/fact-sheets\/all-you-need-to-know-about-the-law\/the-right-of-access-and-how-it-is-exercised\/\"><strong>The right of access and how it is exercised<\/strong><\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>Can I ask a former employee who is exercising their right of access to prove their identity?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\"><strong>\u00a0<\/strong>Yes, in accordance with Article 12 of Law no. 1.565 of December 3, 2024, any natural person wishing to exercise their right of access must <strong>prove their identity<\/strong>. This therefore also applies to a former employee.<\/p>\n<p style=\"text-align: justify;\">However, in accordance with the principle of data minimisation, a data controller must not request more personal data than is necessary to authenticate the person making the request. They must not make the right of access conditional upon the provision of supporting documents that are disproportionate or irrelevant to the request.<\/p>\n<p style=\"text-align: justify;\">A former employee may therefore prove their identity simply by providing their former employee ID or any other information about them known to their former employer.<\/p>\n<p style=\"text-align: justify;\"><strong>To learn more<\/strong>:<\/p>\n<ul style=\"text-align: justify;\">\n<li>Factsheet <a href=\"https:\/\/apdp.mc\/en\/apdp\/fact-sheets\/all-you-need-to-know-about-the-law\/the-right-of-access-and-how-it-is-exercised\/\"><strong>The right of access and how it is exercised<\/strong><\/a><\/li>\n<\/ul>\n<p style=\"text-align: justify;\"><strong>\u00a0<\/strong><\/p>\n<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>What information must be provided to an unsuccessful candidate in a recruitment process who exercises their right of access?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\">Any candidate who exercises their right of access after attending a job interview must receive not only the information they initially provided (such as their CV and cover letter) but also any comments made by the person who conducted the interview, information regarding the processing of these data (purpose(s) of the processing, recipient(s), data retention period, etc.) and the rights available to them (rights to rectify or erase data, to restrict processing or to object to such processing, and the right to lodge a complaint with the APDP).<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>Do I have to provide a former employee with all their old emails if they ask me to?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\">Yes, in principle, a former employee may request a copy of their work emails from their former employer under Article 12 of Law no. 1.565 of December 3, 2024. Depending on the request, this right of access may cover both the personal data contained in the emails and the metadata (time stamps, recipients, etc.).<\/p>\n<p style=\"text-align: justify;\">The employer may, however, refuse a request for access <u>provided they can justify their decision<\/u>.<\/p>\n<p style=\"text-align: justify;\">The right of access is subject to the <strong>rights of third parties<\/strong>. Nor may it infringe <strong>trade secrets<\/strong> or <strong>intellectual property rights<\/strong>.<\/p>\n<p style=\"text-align: justify;\">Thus, when copying business correspondence where the data subject is the sender or recipient, the data controller is advised to first attempt to <strong>delete, anonymise or pseudonymise<\/strong> any data relating to third parties or which infringes a trade secret.<\/p>\n<p style=\"text-align: justify;\">Where the requester is not the sender or the recipient but is mentioned in correspondence, a case-by-case assessment should be carried out of the correspondence that could be disclosed to them, taking into account the rights of third parties, trade secrets and intellectual property.<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify;\"><em>What about personal emails?<\/em><\/p>\n<p style=\"text-align: justify;\">As regards copies of personal emails, however, the employer may not access messages identified as private or whose content is found to be private, even where they have not been identified as such, or where they have been sent or received via the work email account. The employer must therefore provide the <strong>emails in their original form<\/strong> to the requester, provided that the requester is indeed the sender or recipient.<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>Do I have to protect the comments made by another person when a customer asks me for a copy of a telephone conversation they had with a customer service agent?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\">No.\u00a0 Whilst the right of access is limited by respect for the rights of third parties \u2013 meaning that a person may only access data concerning themselves \u2013 an exception applies to the recording of telephone conversations. In such cases, a person taking part in a telephone conversation is not considered a third party.<\/p>\n<p style=\"text-align: justify;\">Before responding to a request for access involving another person, the data controller must balance two conflicting interests: on the one hand, the applicant\u2019s right to obtain a copy of the conversation, and on the other, the likelihood and severity of any potential risks to the rights and freedoms of the person on the other end of the line.<\/p>\n<p style=\"text-align: justify;\">In this specific case, the personal data relating to this third party are very limited, as the content of the discussion is of a professional nature and only their voice is recorded.<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>As a self-employed doctor, do I also have to respond within one month to a patient who asks me for access to the health information I hold?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\">No. Article 12 of Law no. 1.565 of December 3, 2024 provides that the data subject\u2019s access to information concerning their health is subject to the conditions laid down in the legislation on consent and information in medical matters.<\/p>\n<p style=\"text-align: justify;\">Thus, pursuant to Article 12 of Law no. 1.454 of October 30, 2017 on consent and information in medical matters, any person may request access to all information concerning their health held, in any capacity whatsoever, by healthcare professionals or establishments, with the exception, however, of information concerning third parties and the personal notes of healthcare professionals, <strong>within fifteen days of their request<\/strong> or, where such information is more than five years old, <strong>within two months<\/strong>.<\/p>\n<p style=\"text-align: justify;\">However, at the request of the healthcare professional or establishment, the President of the APDP may, following a favourable opinion from the Authority, grant an extension for responding or exempt the data controller from the obligation to respond to requests that are excessive in number, repetitive or systematic in nature. The data subject must then be informed of this.<\/p>\n<p style=\"text-align: justify;\">In the absence of a response within the specified time limit, the request for access is deemed to have been refused.<\/p>\n<p style=\"text-align: justify;\"><strong>\u00a0<\/strong><\/p>\n<p style=\"text-align: justify;\"><span style=\"font-size: 24px;\"><strong>A customer to whom I had sent all the correspondence we had exchanged last year is once again exercising their right of access, this time to obtain the correspondence from this year. Can I charge them for this additional copy?<\/strong><\/span><\/p>\n<p style=\"text-align: justify;\">No, because this is a new request.<\/p>\n<p style=\"text-align: justify;\">Indeed, whilst Article 12 of Law no. 1.565 of December 3, 2024 provides that a data controller may charge a reasonable fee based on administrative costs for any additional copies requested, the first copy must always be free of charge, even if the data controller considers the cost of reproduction to be high.<\/p>\n<p style=\"text-align: justify;\">Consequently, when a data subject requests a copy again, the data controller must consider whether the data subject simply wants an additional copy or whether this is in fact a new request.<\/p>\n<p style=\"text-align: justify;\">Thus, if the duration and scope of the new request are identical to the first, the data controller may charge a reasonable fee. However, if this new request relates to data processed at a different time or concerns a different set of data from the initial request, the right to obtain a copy of the data free of charge applies once again.<\/p>\n<p style=\"text-align: justify;\">In this case, the customer\u2019s second request relates to a different period and different data from their first request, namely the correspondence that has taken place since the first copy was received.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As an online shop, can I ask a customer who wishes to exercise their right of access for a copy of their ID? Yes, but only when there are no other ways to identify the customer. A copy of an ID document should only be requested as a last resort. The data controller must not [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":0,"parent":20260,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-21839","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Request for access rights &#8211; APDP<\/title>\n<meta name=\"description\" content=\"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Request for access rights &#8211; APDP\" \/>\n<meta property=\"og:description\" content=\"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc\" \/>\n<meta property=\"og:url\" content=\"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/\" \/>\n<meta property=\"og:site_name\" content=\"APDP\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-07T12:30:30+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/cas-pratiques-professionnels\\\/request-for-access-rights\\\/\",\"url\":\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/cas-pratiques-professionnels\\\/request-for-access-rights\\\/\",\"name\":\"Request for access rights &#8211; APDP\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/#website\"},\"datePublished\":\"2026-05-28T07:45:18+00:00\",\"dateModified\":\"2026-07-07T12:30:30+00:00\",\"description\":\"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\\\/\\\/apdp.mc\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/cas-pratiques-professionnels\\\/request-for-access-rights\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/cas-pratiques-professionnels\\\/request-for-access-rights\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/cas-pratiques-professionnels\\\/request-for-access-rights\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/apdp.mc\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Professionnals\",\"item\":\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Specific practical cases\",\"item\":\"https:\\\/\\\/apdp.mc\\\/en\\\/professionnels\\\/cas-pratiques-professionnels\\\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Request for access rights\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/apdp.mc\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/apdp.mc\\\/en\\\/\",\"name\":\"APDP\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/apdp.mc\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Request for access rights &#8211; APDP","description":"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/","og_locale":"en_US","og_type":"article","og_title":"Request for access rights &#8211; APDP","og_description":"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc","og_url":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/","og_site_name":"APDP","article_modified_time":"2026-07-07T12:30:30+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/","url":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/","name":"Request for access rights &#8211; APDP","isPartOf":{"@id":"https:\/\/apdp.mc\/en\/#website"},"datePublished":"2026-05-28T07:45:18+00:00","dateModified":"2026-07-07T12:30:30+00:00","description":"APDP - Autorit\u00e9 de Protection des Donn\u00e9es Personnelles \u2013 Principaut\u00e9 de Monaco - official site https:\/\/apdp.mc","breadcrumb":{"@id":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/request-for-access-rights\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/apdp.mc\/en\/"},{"@type":"ListItem","position":2,"name":"Professionnals","item":"https:\/\/apdp.mc\/en\/professionnels\/"},{"@type":"ListItem","position":3,"name":"Specific practical cases","item":"https:\/\/apdp.mc\/en\/professionnels\/cas-pratiques-professionnels\/"},{"@type":"ListItem","position":4,"name":"Request for access rights"}]},{"@type":"WebSite","@id":"https:\/\/apdp.mc\/en\/#website","url":"https:\/\/apdp.mc\/en\/","name":"APDP","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/apdp.mc\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/21839","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/comments?post=21839"}],"version-history":[{"count":4,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/21839\/revisions"}],"predecessor-version":[{"id":21900,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/21839\/revisions\/21900"}],"up":[{"embeddable":true,"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/pages\/20260"}],"wp:attachment":[{"href":"https:\/\/apdp.mc\/en\/wp-json\/wp\/v2\/media?parent=21839"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}