Workload is not an excuse: the DPA confirms the broad scope of the right of access
In a decision of 6 May 2026 (No. 97/2026), the Belgian Data Protection Authority (DPA) once again confirms the broad scope of the right of access. It emphasises in particular that access requests may only be refused in exceptional cases, namely when they are “manifestly unfounded” or “excessive”. According to the DPA, the right of access cannot be restricted solely on the basis of the practical or organisational burden that its implementation entails for the employer.
Facts
A technician requested his employer for access to, and a copy of, all his timesheets over a five-year period (one timesheet per week). For each working day, these forms contained a summary of the work performed and the travel undertaken, based on the employee’s handwritten notes. Through his access request, the employee sought to verify whether his working time had been correctly recorded and remunerated.
The employer did not archive these forms by employee, but by working day, across different files. It provided only a single timesheet and argued that collecting and reproducing the other documents would represent a considerable administrative burden. Alternatively, it offered the employee the possibility to consult the documents on site, requiring him to identify the relevant forms himself. Considering this insufficient, the employee lodged a complaint with the DPA.
Decision of the Litigation Chamber of the DPA
Valid and sufficiently delimited request
The employer argued that the request was unclear and insufficiently motivated. The DPA did not follow this position and recalled that a data subject is not required to provide any justification in order to exercise their right of access. Moreover, the request was sufficiently clearly delimited, as it concerned a well-defined category of documents (timesheets) and a specified period (five years).
The DPA also emphasised the employer’s active duty to cooperate. If a request is unclear, the employer must seek clarification. If it refuses (fully or partially) to comply with the access request, it must inform the person concerned within one month and provide reasons for the refusal. By failing to communicate a formal refusal and, in practice, leaving the request unanswered while merely proposing on-site consultation, the employer breached its obligations under the GDPR.
The DPA further recalled that the right of access also includes the right to obtain a copy, which constitutes an essential component of this right and implies that the person concerned must receive his or her personal data in a durable format. The employer’s proposal to organise only an on-site consultation, without effectively providing a copy, is therefore, in principle, insufficient.
Request neither manifestly unfounded nor excessive
The employer argued that the request was excessive due to the considerable workload involved in collecting, reproducing and anonymising the documents, particularly in light of its archiving system. It claimed that additional staff would need to be engaged in order to comply with such requests.
The DPA recalled that a request may be considered manifestly unfounded or excessive only in exceptional cases of abuse of rights, namely where the request is made solely with the aim of causing harm to the controller (the employer).
According to the DPA, abuse of rights requires both an objective and a subjective element. As regards the objective element, it found that the purpose of the right of access was indeed being pursued in this case: the employee sought access to his personal data and to verify its accuracy. Even if the request was (partly) motivated by another objective, for example in the context of an employment law dispute, this does not affect the right of access.
As regards the subjective element, the employer failed to demonstrate that the employee had artificially created the conditions for the application of the GDPR in order to obtain an undue advantage. The timesheets had been drawn up in the context of a long-standing employment relationship, and the access request was made only several years later. There was therefore no intentional abuse.
Finally, the DPA emphasised that the workload associated with complying with an access request cannot, in itself, render that request excessive, particularly where that workload results from the employer’s internal organisation or archiving system. The GDPR does not provide for a general proportionality limitation allowing the right of access to be restricted on grounds of efficiency or cost considerations. On the contrary, the employer is required to facilitate the exercise of employees’ rights and to organise its processes in such a way that those rights can be effectively exercised.
Third-party data
The employer argued that the timesheets could contain data relating to third parties, in particular clients and the employee’s colleagues. The DPA acknowledged that this may give rise to limitations on the right of access, but stressed that it cannot justify a complete refusal of the access request. Where appropriate, the employer must take suitable measures, such as anonymising third-party data, in order to still be able to provide a copy.
Furthermore, the DPA noted that an on-site consultation of all the files would create a risk that personal data of third parties would be unlawfully disclosed to the employee.
Sanction
In this case, the DPA issued a warning and ordered the employer to provide the employee with a copy of the requested timesheets within one month.
Key message
This decision confirms that the DPA leaves very limited room for relying on grounds for refusal in the context of access requests. Employers cannot invoke practical impact, administrative burden, or their internal organisation in order to restrict the right of access.
The decision also highlights the importance of adequate internal organisation, ensuring that access requests can be handled efficiently and in compliance with the GDPR. Indeed, the threshold for qualifying a request as manifestly unfounded or excessive is particularly high.