What will it cost?
Your requests will be dealt with free of charge.
However, where requests from a data subject are considered ‘manifestly unfounded or excessive’ (as set out in section 12(5) of the GDPR, for example if a data subject is making repeated requests for the same data) the data controller may:
- Charge a reasonable fee, taking into account the administrative costs of providing the information/ taking the action requested; or
- Refuse to act on your request.
In cases where this is used as a reason to refuse an access request or to charge a fee, it is up to the organisation to prove why they believe the request is manifestly unfounded or excessive.