The controller shall provide information on action taken on a request under Articles 15 to 20
to the data subject without undue delay and, at the latest within one month of receipt of the
request. This period may be extended for a maximum of two further months when necessary,
taking into account the complexity of the request and the number of the requests. Where the
extended period applies, the data subject shall be informed within one month of receipt of the
request of the reasons for the delay. Where the data subject makes the request in electronic
form, the information shall be provided in electronic form where possible, unless otherwise
requested by the data subject.
If the controller does not take action on the request of the data subject, the controller shall
inform the data subject without delay and at the latest within one month of receipt of the
request of the reasons for not taking action and on the possibility of lodging a complaint to a
supervisory authority and seeking a judicial remedy.
Information provided under Articles 14 and 14a and any communication and any actions
taken under Articles 15 to 20 and 32 shall be provided free of charge. Where requests from a
data subject are manifestly unfounded or excessive, in particular because of their repetitive
character, the controller may charge a reasonable fee taking into account theadministrative
costs for providing the information or the communication or taking the action requested, or
the controller may refuse to act on the request. In these cases, the controller shall bear the
burden of demonstrating the manifestly unfounded or excessive character of the request.
4a. Without prejudice to Article 10, where the controller has reasonable doubts concerning the
identity of the individual making the request referred to in Articles 15 to 19, the controller
may request the provision of additional information necessary to confirm the identity of the
4b. The information to be provided to data subjects pursuant to Article 14 and 14a may be
provided in combination with standardised icons in order to give in an easily visible,
intelligible and clearly legible way a meaningful overview of the intended processing. Where
the icons are presented electronically they shall be machine-readable.