When Does A First DSAR Become Excessive: Implications Of The CJEU's Brillen Rottler Decision

When can a data access request cross the line from legitimate to abusive? On 19 March 2026, the CJEU ruled in Brillen Rottler (Case C-526/24) that even a first DSAR can be refused under Article 12(5) GDPR as "excessive" where the controller demonstrates it was made with abusive intent. 

Key findings include:

• Decisive factor is intent not just the number of requests: Whether a request is "excessive" turns on both qualitative and quantitative characteristics. While frequency or repetition may be indicators, the data subject's intent is the more decisive factor.
• Burden of proof: Abusive intent must be demonstrated by the controller. Relevant circumstances to consider include the time elapsed between the provision of the data and the access request, the data subject's conduct (such as repeated DSARs followed by compensation claims across multiple controllers), and the underlying objective of the request.