Failure to provide information

If the data controller does not provide the information requested, it must inform the data subject without delay and at the latest within one month of receipt of the request:

• the reasons for not taking action; and

• the possibility of lodging a complaint with the ICO and seeking a judicial remedy.

The information must be provided free of charge unless the requests are manifestly unfounded or excessive, particularly if they are repeated requests. In that case, the data controller can either:

• charge a reasonable fee, or

• refuse to comply.

It is up to the data controller to show that the request is manifestly unfounded or excessive.