It seems some organisations have caught up with the ability to refuse a DSAR because the request is manifestly unfounded or excessive. I am not sure where in the GDPR this was permitted, by which I mean, I don’t think it was. Here are some links. Continue reading “manifestly unfounded or excessive” →