Abusive Access Requests: CJEU Sets Limits to Art. 15 GDPR (C-526/24)

In its judgment of 19 March 2026 (C-526/24), the Court of Justice of the European Union (CJEU) gives concrete shape to the right of access under Art. 15 GDPR and, for the first time, sets clear limits. In the result, the decision strengthens the practical manageability for companies without restricting the broad right of access in its core. The starting point is Art. 15 GDPR:

The right serves to enable the data subject to verify the processing of his or her personal data and to exercise his or her rights effectively.

Excessive access requests entitle the controller to refuse to act or to charge a reasonable fee, Art. 12(5) GDPR.

The CJEU makes clear that even a first-time access request can be "excessive" within the meaning of Art. 12(5) GDPR. What is decisive is not the frequency but the purpose of the request. The consequence is that the controller may refuse to act or may charge a corresponding fee.

A request does not merit protection if it is not aimed at reviewing the data processing but is specifically designed to provoke infringements in order subsequently to assert claims for damages. In this way, the CJEU gives concrete expression to the EU-law principle of the prohibition of abuse of rights in data protection law.

At the same time, however, the Court emphasises the high requirements: the objection of abuse of rights must be interpreted narrowly and examined in light of all the circumstances of the individual case. Blanket assumptions are not sufficient.

The CJEU also confirms that infringements of Art. 15 GDPR can in principle give rise to claims for damages under Art. 82 GDPR – but only where actual damage has occurred.