EU GDPR DSAR Exceptions

Article 12(3) requires the controller to provide information on action taken without undue delay and in any event within one month of receiving the request. The controller may extend that period by two further months only where necessary, taking into account the complexity and number of requests.

The extension is not automatic. The controller must tell the data subject within one month of receipt that it is extending the response period and must give the reasons for the delay.

A controller may request additional information only where it has reasonable doubts about the identity of the person making the request. The additional information must be necessary to confirm identity, not a routine barrier to exercising rights.

If the controller cannot identify the data subject in Article 11 circumstances, Article 12 says the controller does not have to act unless the data subject provides additional information enabling identification. The identity check should be proportionate to the data and risk involved. EDPB guidance allows the response period to be suspended while necessary identity information is outstanding, but only if the controller asks for it without undue delay.

Article 12(5) starts from a free-of-charge rule. A controller may charge a reasonable fee or refuse to act only where the request is manifestly unfounded or excessive, in particular because of its repetitive character. The controller bears the burden of demonstrating that condition. Any fee is limited to the administrative cost of providing the information, communication, or action requested.

EDPB guidance says these concepts must be interpreted narrowly and assessed case by case. Lack of reasons, inconvenience, large internal effort, or the possibility that the requester may use the data in a dispute does not by itself make the request excessive.

Article 15(4) says the right to obtain a copy must not adversely affect the rights and freedoms of others. That is not a general permission to reject the whole DSAR. The controller should assess the concrete conflict and provide access in an adjusted form where reconciliation is possible.

Typical handling is to leave out or render illegible the parts that would adversely affect others, while still providing the data subject's accessible personal data and Article 15 information where the GDPR allows it.

The record should show that the controller started from the right of access and applied only the GDPR limit needed for the specific request. It should be usable by privacy, legal, support, and product teams without adding unsupported national derogations or authority-specific procedures.

Where a controller relies on Union or Member State restrictions under Article 23, identify the applicable legislative measure and check its scope, conditions, necessity, and proportionality. Keep that analysis separate from the Article 12 and 15 assessment; a general reference to national law is not enough to establish a restriction.