Section 12 — Data Protection Act 2018: Limits on fees that may be charged by controllers

Limits on fees that may be charged by controllers 12 1 The Secretary of State may by regulations specify limits on the fees that a controller may charge in reliance on—

a Article 12(5) of the UK GDPR (reasonable fees when responding to manifestly unfounded or excessive requests), or b Article 15(3) of the UK GDPR (reasonable fees for provision of further copies).

2 The Secretary of State may by regulations—

a require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in reliance on those provisions, and b specify what the guidance must include.

3 Regulations under this section are subject to the negative resolution procedure.