ECJ on GDPR Access Requests: Even a first Request can be abusive

The right of access under Article 15 GDPR has become a standard instrument both in employment relationships and in recruitment processes. In its judgment of March 19, 2026 (C-526/24), the European Court of Justice (ECJ) clarified that an access request may, in individual cases, be classified as “excessive” within the meaning of Article 12(5) GDPR if it is submitted abusively, even where it is a first-time request. At the same time, however, the Court emphasized that access requests must continue to be taken seriously and that the abuse objection applies only in limited circumstances.

ECJ: A Request Pursuing Exclusively Abusive Purposes Is Excessive

The case concerned an individual who submitted an access request under Article 15 GDPR to a company only 13 days after signing up for its newsletter. The company rejected the request on the grounds that it constituted an abuse of rights. The individual subsequently sought compensation under Article 82 GDPR.

In its defense, the company argued, among other things, that the individual systematically submitted access requests to various companies in order to deliberately generate compensation claims for alleged GDPR violations. Following a referral from the local court, the ECJ clarified that an access request may be classified as excessive where it is made exclusively for abusive purposes. However, the data controller must demonstrate the existence of such abuse on the basis of objective circumstances.

Abuse Objection Possible Even for a First Request – Burden of Proof Lies with the Employer

For employers, the decision does not represent a fundamental departure from existing data protection principles. The right to access personal data under Article 15 GDPR remains the general rule. Access requests from employees and applicants must continue to be handled properly and in accordance with GDPR requirements.

The ECJ nevertheless made clear that the abuse objection is not automatically excluded simply because the request is being made for the first time. What matters is an assessment of the specific circumstances of each individual case. Employers must be able to provide concrete and reliable evidence showing that the request was submitted solely for the purpose of creating the basis for a compensation claim under Article 82 GDPR.

High Hurdles remain for Employers, and Liability Risks continue to be significant

The decision strengthens employers' position only in a narrowly limited category of clearly abusive access requests. The threshold for lawfully rejecting a request remains high because the burden of presentation and proof lies with the controller.

An access request may only be refused if it is manifestly unfounded or excessive. The mere strategic use of the right of access before or during employment-related disputes is not sufficient on its own. Unjustified refusals continue to carry significant liability risks.

What Should Employers Do?

Against this background, employers should continue to ensure the careful, structured, and timely handling of access requests. A blanket or premature rejection based on a presumed abuse of rights is not advisable.

Where there are concrete indications that a request serves exclusively abusive purposes, a legal assessment should be carried out before rejecting it. Employers should also document all relevant facts comprehensively. Only in this way can the risks of an unjustified refusal and potential claims under Article 82 GDPR be minimized.

Conclusion: Rejection Remains the Rare Exception

Access requests submitted by employees and applicants generally continue to require a response. Rejecting a request on the basis of abuse of rights remains the exception and requires specific, objectively verifiable indications.

While the ECJ has opened the door to raising an abuse objection even against a first-time access request in individual cases, it simultaneously emphasized the exceptional nature of such situations. In practice, it therefore remains essential to examine access requests carefully while exercising caution before refusing them, in order to avoid unnecessary liability risks.