What will it cost?

Your requests will be dealt with free of charge.

However, where requests from a data subject are considered ‘manifestly unfounded or excessive’ (as set out in section 12(5) of the GDPR, for example if a data subject is making repeated requests for the same data) the data controller may:

  1. Charge a reasonable fee, taking into account the administrative costs of providing the information/ taking the action requested; or
  2. Refuse to act on your request.

In cases where this is used as a reason to refuse an access request or to charge a fee, it is up to the organisation to prove why they believe the request is manifestly unfounded or excessive.