A data subject access request (DSAR) enables individuals to understand how their personal data are being processed and verify the lawfulness of that processing. The difficulty for controllers arises when the circumstances suggest that a request may be intended to create the conditions for a compensation claim rather than to exercise the right of access. When can such a request be considered abusive, and what evidence must a controller have to justify refusing to act on it?

Two judgments of the Court of Justice of the European Union (CJEU), Österreichische Datenschutzbehörde (C-416/23) and Brillen Rottler (C-526/24), provide important clarification on these questions.

The right of access and its limits

The right of access is a fundamental right recognised by Article 8(2) of the Charter of Fundamental Rights of the European Union (the Charter), which grants individuals the right to access personal data collected concerning them. Read alongside Article 7 of the Charter, which protects the right to respect for private and family life, it forms part of the broader framework safeguarding individuals against unlawful processing and lack of transparency in the handling of their personal data.

Article 15(1) of the General Data Protection Regulation (GDPR) gives data subjects the right to obtain confirmation as to whether their personal data are being processed and, if so, access to those data and specified information about the processing. This right enables individuals to understand how their personal information is used, verify the lawfulness of the processing and, where appropriate, exercise other rights under the GDPR. Controllers must therefore facilitate access requests rather than treat them as an administrative inconvenience.

Nevertheless, the right of access is not unlimited. Under Article 12(5) GDPR, a controller may charge a reasonable fee reflecting administrative costs or refuse to act where a request is manifestly unfounded or excessive. The controller bears the burden of demonstrating that the relevant threshold has been met. The difficulty lies in determining what makes a request excessive, particularly where the concern relates not to the volume of information requested or the frequency of previous requests, but to the data subject’s underlying intention.

Is repetition necessary for a request to be excessive?

Article 12(5) GDPR refers to requests that are manifestly unfounded or excessive, “in particular because of their repetitive character”. Does this mean that a request must be repeated before it can be considered excessive, or can a first request already fall within this exception?

In Österreichische Datenschutzbehörde (C-416/23), decided on 9 January 2025, the CJEU considered whether a high number of complaints submitted to a supervisory authority could, in itself, justify treating them as excessive under Article 57(4) GDPR. The Court held that the number of complaints submitted within a particular period was not sufficient, on its own, to establish excessiveness. The supervisory authority had to demonstrate an abusive intention on the part of the complainant. An approach based solely on the number of complaints risked arbitrarily restricting the effective exercise of the rights conferred by the GDPR.

Although this judgment concerned complaints to a supervisory authority rather than DSARs submitted to controllers, its reasoning is directly relevant. The Court explained that Article 57(4) GDPR, which is worded in substantially similar terms to Article 12(5) and pursues the same objective, reflects the general principle of EU law that its provisions cannot be relied upon for abusive or fraudulent ends. The exercise of rights must therefore be assessed in a way that protects their effective enjoyment while preventing their abusive use.

The CJEU addressed the issue directly in Brillen Rottler (C-526/24), decided on 19 March 2026, confirming that a first request for access under Article 15 GDPR may be considered excessive. The words “in particular because of their repetitive character” identify an example of circumstances in which excessiveness may arise; they do not make repetition a prerequisite. Equally, the number of requests is not decisive in establishing abuse. The Court requires a qualitative assessment of the request in light of all the relevant circumstances, with Article 12(5) interpreted restrictively and refusal reserved for exceptional cases. This approach preserves the effective protection of data subjects’ fundamental rights without extending the protection afforded by EU law to abusive conduct.

What evidence can establish an abusive DSAR?

In Brillen Rottler, the CJEU clarified the criteria for establishing an abuse of rights. Drawing on its previous case law, the Court identified two elements that must be considered together: an objective element and a subjective element.

1. The objective element: Has the purpose of the right of access been undermined?

The objective element concerns whether, despite formal compliance with the conditions laid down by EU law, the purpose of the relevant rules has not been achieved. The purpose of Article 15 GDPR, read in light of Recital 63, is to enable individuals to understand how their personal data are processed, verify the lawfulness of that processing and, where appropriate, exercise their other rights under the GDPR.

In Brillen Rottler, the individual had subscribed to a company’s newsletter by voluntarily providing personal data and subsequently submitted an access request. Although the request formally fell within Article 15, formal compliance alone did not rule out abuse. The request must be assessed against the purpose of the right of access; an unusual request or the controller’s doubts about the individual’s motivation do not, by themselves, establish that the objective element is satisfied.

2. The subjective element: Was there an intention to obtain an advantage abusively?

The subjective element concerns whether the data subject intended to obtain an advantage under EU law by artificially creating the conditions necessary to obtain it. In the context of a DSAR, this may arise where the request was made to create the conditions for obtaining compensation under the GDPR, rather than to understand the processing, verify its lawfulness and subsequently protect the individual’s rights.

The CJEU stressed that the controller must demonstrate unequivocally that the request was made with such an abusive intention. In paragraph 42 of Brillen Rottler, the Court identified the following circumstances as relevant to that assessment:

• The circumstances in which personal data were provided: whether the individual was obliged to provide the data and the purpose for which they were provided;
• The timing of the request: the time elapsed between the provision of the personal data and submission of the DSAR;
• The individual’s conduct: conduct or circumstances that may help establish the intention behind the request.

The facts of Brillen Rottler illustrate how these considerations may arise in practice. The individual had voluntarily subscribed to a German optician’s newsletter, providing his personal data and consenting to their processing, and submitted an access request shortly afterwards. After the company refused the request, he repeated it and claimed compensation for alleged non-material damage. The company argued that publicly available information indicated that he systematically submitted access requests to different controllers, followed by compensation claims.

In paragraph 43, the CJEU confirmed that such publicly available information may be taken into account when assessing abusive intention, provided it is supported by other relevant material. The Court did not itself determine that the individual had acted abusively; it left the referring court to assess whether the controller had provided sufficient evidence of an abusive intention, taking into account all the relevant circumstances.

These considerations are illustrative, not an exhaustive checklist. Their relevance will depend on the circumstances of each case, and no single factor automatically establishes abuse.

What does this mean for controllers?

The Brillen Rottler judgment gives controllers greater clarity when dealing with potentially abusive DSARs, but it does not create a general exception for requests that appear commercially motivated or may be followed by compensation claims.

Importantly, the threshold for relying on Article 12(5) GDPR remains particularly high. As an exception to the general obligation to facilitate the exercise of data subject rights, this provision must be interpreted restrictively. The burden of proof rests squarely on the controller, which must demonstrate, on the basis of concrete evidence and all the relevant circumstances, that the request was made with an abusive intention. Mere suspicion or assumptions regarding the data subject’s motives will not suffice to justify a refusal.

For controllers, the challenge is to distinguish genuinely abusive requests from legitimate exercises of the right of access. An unjustified refusal may itself infringe the data subject’s rights and give rise to a claim for compensation under Article 82 GDPR, provided the applicable requirements are satisfied.

Assessing potentially abusive DSARs therefore requires careful consideration of the circumstances and the evidence available in each case.

How CSB Group can assist

CSB Group can support your organisation in navigating complex DSARs, assessing potential GDPR risks and reviewing its data protection procedures. Contact our team to discuss how we can help your business manage its data protection obligations effectively.