Access requests and other GDPR rights at a law firm
The date of receipt gives the last day to reply, each step of the calculation, the limits to check for each requester and five letters to review, in the language you choose.
What the rule says
Rules verified on 07/10/2026
Answer a data subject's request without undue delay and within one month of receipt. Where the request is complex or requests are many, the firm may extend by two further months, provided it tells the person within the first month and gives the reasons (GDPR art. 12(3)). The month is counted under Regulation 1182/71: a last day on a Saturday, a Sunday or a Belgian public holiday moves to the next working day.
Professional secrecy does not apply against the firm's own client asking for their own data (APD decision 99/2026). A doubt about identity is a reason to ask, not to refuse.
Your result appears here
The result appears as soon as the required fields are filled in.
An access request from a former client received on Saturday 31 January 2026.
Sources
Rules verified on 07/10/2026
- Regulation (EU) 2016/679 (GDPR)
- Regulation (EEC, Euratom) No 1182/71 (periods, dates and time limits)
- EDPB Guidelines 01/2022 on the right of access, v2.1
- Belgian DPA, Litigation Chamber, decision 99/2026 of 8 May 2026 (law firm)
- CJEU, 26 October 2023, C-307/22 (first copy free of charge)
- Law of 18 September 2017 (anti-money laundering), arts. 60 to 65
- OVB, GDPR-wijzer: data subjects' rights
- FPS Justice: new Penal Code in force on 1 September 2026 (professional secrecy, art. 352)
- FPS Employment: public holidays
A drafting aid based on the sources cited. To be reviewed and adapted by the lawyer; it is neither advice nor a guarantee of compliance.
How it works
How the calculation works
- Starting point. The day the request reaches the firm through any channel, even if nobody has read it yet (EDPB Guidelines 01/2022, §159). That day is not counted (Regulation 1182/71, art. 3(1)).
- One month. The period ends on the same date of the following month; if that date does not exist, on the last day of that month (art. 3(2)(c)).
- Non-working day. A last day on a Saturday, a Sunday or a Belgian public holiday moves to the next working day (art. 3(4); EDPB §161).
- Extension. Two further months where the request is complex or requests are many, to be announced with the reasons within the first month (art. 12(3) GDPR). The tool takes receipt plus three months, then the same roll-forward: the most cautious reading.
- Identity. Where the firm asked without delay for information to verify identity, the period is suspended until the answer; the tool adds the days of suspension to the deadline.
Example: a request received on Saturday 31 January 2026 must be answered by Monday 2 March 2026 (28 February is a Saturday). Extended, the deadline becomes Thursday 30 April 2026.
The limits for each requester
- A client or former client: professional secrecy cannot be held against them for their own data (Belgian DPA, decision 99/2026, §40). The copy masks third parties' data (art. 15(4)). The first copy is free (CJEU, C-307/22).
- An opposing party or another third party: a decision for the lawyer. The OVB considers that data received from the client may be refused without confirming that they exist, as disclosure would breach secrecy towards the client (Penal Code art. 352); data received from the person are given to them, masking what secrecy protects.
- An AML file: rights are fully restricted (Law of 18 September 2017, art. 65); the person may turn to the Belgian DPA. Never reveal whether an analysis or a report exists.
- For someone else: a mandate for an adult; parental authority is enough for a minor (APD 99/2026).
- A manifestly unfounded or excessive request: read strictly, and the firm bears the burden of proof (art. 12(5)).
The letters
The acknowledgement, the request for information to verify identity, the reasoned extension notice, the reply (for access: the information of art. 15(1) with the copy; for other rights: the action taken and the notice to recipients) and the reasoned refusal with the right to complain to the Belgian DPA and to seek a judicial remedy (art. 12(4)). With a verified address, they carry your firm's letterhead.
What the tool does not do
- It does not decide for you what professional secrecy covers.
- It does not gather the data to disclose: the letter's blanks are yours to complete.
- It sends nothing: names and addresses stay in this tab; only dates and options appear in the page address. The calendar file contains no name.
Verification
The rules were checked on 7 October 2026. The tool assists the lawyer, who remains responsible for the reply and the calculation.
Updated on 7 October 2026
Frequently asked questions
When does the one-month period start?
On the day the request reaches the firm through an official channel, even if nobody reads it that day (EDPB Guidelines 01/2022, §159). That day is not counted: a request received on 7 October expires on 7 November, or on the next working day if 7 November is a Saturday, a Sunday or a public holiday.
Can a request be refused because the requester's identity is doubtful?
No. A doubt allows the firm to ask for more information (art. 12(6) GDPR), not to refuse. In decision 99/2026, the Belgian DPA criticised a firm for rejecting a request on an identity "not proven" without ever asking for proof. Ask first through a channel the firm already knows (the file's e-mail address, the file reference); a copy of an identity card only if necessary, letting the person mask what is not needed.
Does professional secrecy allow access to be refused?
Not to clients asking for their own data: secrecy protects them and cannot be held against them (APD 99/2026, §40). Towards an opposing party, it remains a decision for the lawyer: the OVB accepts a refusal for data received from the client, without confirming that they exist. No Belgian DPA decision on this case was found.
Can the firm charge a fee?
The reply and the first copy are free, even if the request serves a dispute (arts. 12(5) and 15(3) GDPR; CJEU, C-307/22). A reasonable fee is possible only for further copies or for a manifestly unfounded or excessive request, which the firm must show. Reminders caused by the firm's own refusals do not make the request repetitive (APD 99/2026).
How is the period extended?
By telling the person before the end of the first month, with the reasons (complexity, number of requests) and the new deadline: two further months at most (art. 12(3)). The "Extension notice" letter sets these out.
Can a parent ask for a child's data?
Yes: parental authority is enough for a minor, and the firm must give the child's data (APD 99/2026, §32). For an adult, a mandate is needed; without one, that person's data are not disclosed.