Repeat, bulk or hostile data requests: a GDPR Article 12(5) decision sheet for when a small business may charge a fee or refuse, and the proof to keep
What you get: a finished Article 12(5) decision sheet in three tabs: a screening log with one row per request and a formula that sorts it into "answer free of charge", "combine with the open request", "possibly excessive" or "not a 12(5) case", a fee or refuse tab that records the planned-fee notice before you charge anything, and a proof file with the reply-by date and the three things every refusal letter must say, plus four made-up example rows.
Short answer: GDPR replies are free of charge. Only when a request is manifestly unfounded or excessive, "in particular because of their repetitive character", may you charge a reasonable fee based on administrative costs or refuse to act, and you carry the burden of showing it (Article 12(5) GDPR). The EDPB says these concepts must be interpreted narrowly, that a request is not excessive just because it gives no reason, uses rude language, takes a lot of effort or may lead to a claim, and that you should tell the person before charging a fee so they can withdraw (Guidelines 01/2022, paras. 175, 188, 189 and 194).
Why AI tools make this come up more
Small businesses now receive requests drafted with AI writing tools, sent through request services, or repeated in a chatbot several times a week. They can look like spam. Our reading of the EDPB guidance: the way a request is written is not a ground on its own, because there are "only very few prerequisites" for an access request (para. 177) and a request should not be regarded as excessive because no reasons are given or you regard it as meaningless (para. 189). What can matter is repetition with nothing changed, an overlap with a request you are still answering, or clear intent to disrupt. Check identity separately with the Article 12(6) identity check sheet.
Step 1: tab 1, screening log (one row per request)
| Column | What to write | Source |
|---|---|---|
| A. Request ref | Same reference as in your request deadline tracker | |
| B. Received on | Date it reached any of your channels, including a chatbot | Art. 12(3) |
| C. Right used | Access (Art. 15), rectification, erasure, restriction, portability or objection | Art. 12(5) covers actions under Arts. 15 to 22 |
| D. Data you clearly do not process? | Yes if the request is about data or activities that are obviously not yours, for example another company's app | EDPB paras. 178, 179, example 38 |
| E. Offer to withdraw for a benefit, stated aim to disrupt, or a campaign of different requests (for example weekly) to cause disruption? | Yes or No. If Yes, paste the exact words or list the dates | EDPB para. 190 |
| F. Overlaps a request you are still answering? | Yes if it asks for exactly the same information and the earlier one is still open and not yet late | EDPB para. 187 |
| G. Last answered on | Date you last answered the same person in full; blank if never | Recital 63, "reasonable intervals" |
| H. Same information as last time? | Yes or No | EDPB para. 185 |
| I. Has their data or your processing changed since? | Yes, No or Don't know. New order, new chatbot chat, new call recording, new AI tool added = Yes | EDPB paras. 184, 185 |
| J. Self-service export available? | Yes if the person can download their data from an account in a few clicks | EDPB para. 186 |
| K. Result | =IF(D2="Yes","Not a 12(5) case: confirm whether you hold their data",IF(E2="Yes","Possibly excessive: document the facts, go to tab 2",IF(F2="Yes","Overlap: combine with the open request",IF(AND(G2<>"",H2="Yes",I2="No",J2<>"Yes",B2-G2<365),"Possibly excessive (repeat): go to tab 2","Answer free of charge")))) | EDPB paras. 175 to 190; formula is our working rule |
The 365-day line comes from the EDPB: a one-year interval between free answers "will in any case be too large" for the request to be considered excessive (example 41). It is not a minimum wait: a request a month later can be fine if the person has reason to think the data changed. "Don't know" in column I always gives "Answer free of charge". If the new request covers exactly the same information in scope and time, the EDPB treats it as a request for a further copy, for which Article 15(3) allows a reasonable fee (footnote 102).
Step 2: tab 2, fee or refuse
| Column | What to write | Source |
|---|---|---|
| A. Request ref | From tab 1 | |
| B. Ground | "Manifestly unfounded" or "Excessive: repeat" or "Excessive: abusive" | Art. 12(5); EDPB paras. 177, 181, 188 |
| C. Suggested measure | =IF(B2="Excessive: repeat","Planned fee notice first","Consider refusal: Art. 12(4) letter") | EDPB para. 192: a fee is hardly suitable for manifestly unfounded requests and often more appropriate for repeat ones; formula is our working rule |
| D. Admin cost basis | Minutes of staff time × hourly cost, plus any export or postage cost. Write the sum, not a round number | Art. 12(5)(a) "administrative costs"; method is our working rule |
| E. Planned-fee notice sent on | Date you told the person the fee and that they can withdraw instead | EDPB para. 194 |
| F. Person's choice | "Withdrew", "Paid", "Disputed: review again", "No reply" |
Neither box is automatic: the EDPB says you are not free to pick either measure and must decide on the facts of each case (para. 192). Most small businesses will find that answering is quicker than defending a refusal.
Step 3: tab 3, proof file and letter
| Column | What to write | Source |
|---|---|---|
| A. Facts kept | Dates of earlier requests and answers, what changed, the exact words relied on in column E. Facts only, no opinions about the person | Art. 12(5) third sentence; EDPB paras. 176, 193 |
| B. Reply-by | =WORKDAY(EDATE(Tab1!B2,1)-1,1,Holidays) | Art. 12(4): reasons without delay, at the latest within one month; same Holidays range as the deadline tracker |
| C. Letter says why | The concrete reason, not "your request is excessive" | EDPB paras. 174, 193 |
| D. Letter names the right to complain | To a data protection authority | Art. 12(4), Art. 77 |
| E. Letter names the right to go to court | Judicial remedy | Art. 12(4), Art. 79 |
| F. Ready to explain to the authority? | Yes when A to E are filled | EDPB para. 176 |
Four made-up example rows
| Request | Result | What happened |
|---|---|---|
| Café customer sends an AI-written access request with no reason given and a sharp tone | Answer free of charge | Answered in 6 days; tone and missing reason are not grounds (EDPB para. 189) |
| Same person asks a furniture maker for the same invoice data 2 months after a full answer; no new order | Possibly excessive (repeat) | Planned-fee notice sent with the cost basis; the person withdrew. Compare EDPB example 39 |
| Second identical request arrives while the first is 10 days into its month | Overlap | Both answered together in one reply |
| Former client's email offers to withdraw the request if an invoice is cancelled | Possibly excessive | Email kept in the proof file; refusal letter with reason, complaint and court rights sent within the month |
These rows are made up for illustration and do not describe any real business.
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 12(4), 12(5) and 15(3) and Recital 63, as published on gdpr-info.eu) and the EDPB Guidelines 01/2022 on the right of access, version 2.0 (paras. 174 to 195, examples 38 to 41, footnote 102). The EDPB guidance is written for access requests; we apply the same screening to the other rights in Articles 16 to 22 as our working rule. The result formula, the cost method and the fee-or-refuse suggestion are our own working rules. The EDPB warns that unjustified rejections can be treated as infringements (para. 195), and national laws under Article 23 may add rules, so check your data protection authority's guidance. Checked on 27 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often want to refuse a repeat request from a former customer or employee. Hand them tab 1 first: in most rows it says "answer free of charge". Use it with the client AI inventory, stay inside your professional rules and refer legal questions on.
Know which AI tools hold each person's data
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Its list of AI tools answers column I quickly (did anything change since the last answer?), and you can attach this sheet as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: Article 12 deadline tracker · Article 12(6) identity check · Article 15 access requests · Article 17 and 21 requests
Sources
- Article 12 GDPR, Article 15 GDPR and Recital 63; official text: Regulation (EU) 2016/679
- EDPB Guidelines 01/2022 on data subject rights, right of access, version 2.0 (section 6.3, paras. 174 to 195, examples 38 to 41)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.