When responding to a right to access request, organizations must provide detailed information about the personal data they hold. This includes:
The categories of personal data collected The purposes for which the data is processed The recipients or categories of recipients to whom the data has been disclosed The retention periods for the data The source of the data, if it was not collected directly from the individual The existence of automated decision-making, including profiling