Section 53 — Data Protection Act 2018: Manifestly unfounded or excessive requests by the data subject

Manifestly unfounded or excessive requests by the data subject 53 1 Where a request made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—

a charge a reasonable fee for dealing with the request, or b refuse to act on the request.

2 An example of a request that may be excessive is one that merely repeats the substance of previous requests.

3 In any proceedings where there is an issue as to whether a request described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.

4 The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a). 4A The Secretary of State may by regulations—

a require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a),

and b specify what the guidance must include.

5 Regulations under this section are subject to the negative resolution procedure.

6 If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—

a the reasons for not doing so, and b the data subject’s right to lodge a complaint with the Commissioner.

7 The controller must comply with subsection (6)—

a without undue delay, and b in any event, before the end of the applicable time period (as to which see section 54).