Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 53 is up to date with all changes known to be in force on or before 09 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 3Rights of the data subject
Supplementary
53Manifestly unfounded or excessive requests by the data subject
(1)
Where a request F1made by a data subject under or by virtue of any of sections 45, 46, 47, 50C or 50D is manifestly unfounded or excessive, the controller may—
(a)
charge a reasonable fee for dealing with the request, or
(b)
refuse to act on the request.
(2)
An example of a request that may be excessive is one that merely repeats the substance of previous requests.
(3)
In any proceedings where there is an issue as to whether a request F2described in subsection (1) is manifestly unfounded or excessive, it is for the controller to show that it is.
(4)
The Secretary of State may by regulations specify limits on the fees that a controller may charge in accordance with subsection (1)(a).
F3(4A)
The Secretary of State may by regulations—
(a)
require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and
(b)
specify what the guidance must include.
(5)
Regulations under F4this section are subject to the negative resolution procedure.
F5(6)
If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—
(a)
the reasons for not doing so, and
(b)
the data subject’s right to lodge a complaint with the Commissioner.
(7)
The controller must comply with subsection (6)—
(a)
without undue delay, and
(b)
in any event, before the end of the applicable time period (as to which see section 54).