First and foremost, you have the right to access data stored about you. But, you also have the right to access the following information:
Who (individual, private entity or public authority) has received your personal data?
The data user (controller) may partly of fully refuse to provide you with access to the requested data if there is a compelling need to protect other important interests.
Articles 27, 35
Applicable as of 25 May 2018
Joint publication by the the EU Agency for Fundamental Rights and the Council of Europe