1. 資料主體有權向控管者確認其個人資料是否正被處理，於此情形 者，資料主體應有權接近使用其個人資料及下列資訊：
1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
(d) 如可能，個人資料將被儲存之預期期間，或如告知期間不可能者， 確定該期間所採用之標準；
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
(e) 向控管者請求更正或刪除或限制處理或拒絕處理與資料主體相關 個人資料之權利；
(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
(g) 個人資料非自資料主體蒐集所得者，關於該來源之任何充分資 訊；
(g) where the personal data are not collected from the data subject, any available information as to their source;
(h) 存在第 22 條第 1 項及第 4 項所定自動決策（包括建檔）者，至 少在該等情況，為資料主體之處理所涉及的邏輯性有意義資訊，以及 重要性與預設結果。
(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. 如個人資料移轉至第三國或至國際組織，該資料主體應有權獲知 關於該傳輸依第 46 條所定之適當保護措施；
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
3. 控管者應提供所在處理之個人資料副本乙份。資料主體所要求之 任何更多副本，控管者得依行政成本收取合理費用。如資料主體係以 電子方式提出請求，除資料主體有不同要求外，該資訊之提供亦應以 電子方式為之。
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
(63) 資料主體應有權接近使用其所受蒐集之個人資料，並得容易地、 於合理之時間間隔行使接近使用權，以知悉並核實該處理之合法性。 此包括資料主體有權接近使用其健康資訊，例如包括診斷、檢驗結果、 醫師所為評鑑及任何治療或干擾措施提供之資訊。因此，各資料主體 應有權知悉及獲得溝通，尤其是個人資料受處理之目的、受處理之可 能期間、個人資料之接收者、任何自動處理個人資料所涉及之邏輯、 以及至少於建檔時之資料處理結果。若有可能，控管者應提供得遠端 使用之安全系統以提供資料主體對其個人資料有直接之接近使用權。 該權利不得對他人之權利或自由有不利之影響，包括營業秘密或智慧 財產權，尤其是保護軟體之著作權。但是，就此等面向之顧慮不得導 致拒絕提供所有資訊予資料主體之結果。當控管者處理有關資料主體 之大量資訊時，應得於資訊傳遞前請求資料主體特定與其請求相關之 資訊或處理活動。
(63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.
(64) The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.