So, Article 15 of the GDPR gives the user the right to access all the personal data concerning him or her.
Assume we have a website with user accounts. We store some information that is regarded as personal data. However, the user can easily access all of this data via browsing the website while logged into their account.
Can we respond to article 15 requests by referring them to log in to the website and browse around? Or do we explicitly need to gather all their personal data into a single file and give them this?