Can a controller charge an administrative fee for providing information in oral format to data subjects?

Under the General Data Protection Regulation (GDPR), a controller is prohibited from charging a fee for providing access to personal data, including when it is requested in oral format. The regulation is designed to ensure that individuals can exercise their rights without facing barriers, such as financial costs.

When individuals request access to their data or seek information about how their data is being processed, the response must be provided free of charge. However, there are specific circumstances where a controller might charge a reasonable fee, for instance, if the requests are manifestly unfounded or excessive, particularly if they are repetitive in nature.

The requirement for free access is rooted in the GDPR’s objective to enhance transparency and provide individuals with control over their personal data. This allows individuals to be informed about their rights and how their data is utilized without the barrier of additional costs.