Article 15.3 of GDPR states that the first copy of a data subject access request (DSAR) should be provided to the data subject free of charge. However, if the data subject requests subsequent copies of a DSAR, your company can charge a reasonable fee. This fee should be based on the administrative costs of complying with the request.
If the data subject complains to the supervisory authority about being charged for a DSAR (which is within the rights of a data subject) then the burden is on your company to prove that the fee assessment was fair. Learn more about what GDPR says about data subject access requests (DSARs) here and download our GDPR Guide to learn more.
