Right of access (RoA) / data subject access requests (DSAR) policy and procedure

Processing a subject access request

The GDPR allows most requests to be made free of charge. However, a “reasonable fee” can be charged for further copies of the same information and when a request is “manifestly unfounded or excessive”, particularly if it is repetitive. The fee must be based on the administrative cost of providing the information.