Access Fees under GDPR (Article 12(5))

The General Data Protection Regulation (GDPR) gives data subjects the right of access to their personal data (Article 15). Controllers must generally provide this information free of charge.

However, GDPR does recognize some limited situations where a fee may be charged:

1. General Rule

  • Access requests must be processed free of charge.
  • Includes providing a copy of personal data undergoing processing.

2. Exceptions: When a Fee May Be Charged

According to Article 12(5) GDPR:

A “reasonable fee” (based on administrative costs) may be charged if:

  • The request is manifestly unfounded (e.g., no genuine purpose, malicious intent).
  • The request is excessive (e.g., repetitive or too frequent).
  • The individual requests additional copies of their personal data (beyond the first copy, which is free).

3. Limitations on Fees

  • The fee must be reasonable and reflect actual administrative costs (e.g., staff time, printing, postage).
  • The burden of proof lies with the controller to demonstrate that a request is unfounded or excessive.
  • Supervisory authorities can investigate controllers that set unreasonably high fees.

Comparison: GDPR vs. POPIA (South Africa)

Since you are in South Africa, it's useful to compare:

  • POPIA allows an access fee prescribed by regulation (Promotion of Access to Information Act (PAIA) schedules include fees).
  • GDPR does not prescribe a specific amount; instead, it requires reasonableness, proportionality, and justification.

Practical Example under GDPR

  • A data subject asks for access to their employment file. The company provides it electronically, free of charge.
  • Later, the same individual requests five more paper copies. At this point, the employer may charge a reasonable fee covering printing and postage.
  • If the same individual submits weekly repetitive requests without any new justification, the controller may either charge a fee or refuse to act (with reasons documented).

✅ In summary:

  • GDPR does not prescribe a fixed access fee.
  • First copy = free.
  • Additional copies or excessive/unfounded requests = controller may charge a reasonable, cost-based fee.