A couple of points to answer your question: 1. Yes, when exercising your "right of access", companies would have to send you all the personal data they have on

A couple of points to answer your question: 1. Yes, when exercising your "right of access", companies would have to send you all the personal data they have on you, except when disclosing this information would harm others (ie: notes of your manager about your performance or the example you gave) The exception does not mean that they can blankly refuse to give you any data, only the "offensive" part must be refused. By definition, that is still considered personal data however. As M2Ys4U mentioned: inferred data is also personal data. 2. there is a case where you don't have to provide all information: the right of data portability only applies to data provided by the data subject. 3. Someone is referencing article 14 below. That is not the same as giving access to data. Article 14 specifies how a data subject must be informed about processing of his data when you've received the data from someone else. For example: you've received someone's info from a recruiter and you now want to process his data to see if this person is a valid prospect. The article works together with article 13 (how to inform a data subject on what you are doing with the data he gives to you directly). Together, these articles are the reason for 50% of the privacy notices of the last couple of months :-)