Skip to content
VITI Security
Contact

GDPR - Art. 12-15

GDPR DSR Cost Calculator

Cost out your data subject request workload and check the response deadlines that apply.

Multi-system, high-volume or contested requests.

The deadline

You must respond to a data subject request without undue delay and within one month of receiving it (Art 12(3)). You can extend by two further months where necessary, taking into account the complexity and number of requests, but you must tell the person within the first month and explain why.

Fees and refusals

  • Responding is free of charge (Art 12(5)).
  • If a request is manifestly unfounded or excessive, particularly because it is repetitive, you can charge a reasonable fee or refuse, but you must be able to show why.
  • For an access request, you can charge a reasonable fee for further copies (Art 15(3)).
  • If you have reasonable doubts about who is asking, you can request information to confirm their identity (Art 12(6)).

The rights behind the requests

Access, rectification, erasure, restriction, portability and objection, plus rights around automated decision-making (Art 15-22). Access requests are usually the most common, and the most work.

What drives the cost

Most of the time goes on finding the person's data across systems, checking it, and redacting other people's information. The calculator above treats complex requests as taking three times the average. Mapping where personal data lives, and searching systems by one identifier, is what brings the cost per request down.

See GDPR Article 32 security and the GDPR fine calculator.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Effective minutes per request = average minutes x (1 + 2 x share of complex requests). That assumes a complex request takes three times as long as an average one; the share is capped at 100%.
  2. Staff hours per month = requests x effective minutes / 60. Monthly cost = hours x hourly cost; annual cost = monthly cost x 12.
  3. Colour: monthly cost above EUR 5,000 is red, above EUR 1,000 amber, otherwise green.
  4. The deadline and fee rules shown with the result come straight from GDPR Art 12 and 15; they do not change the cost figure.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Complex request handling time
3x the average
Colour thresholds (monthly cost)
Amber above EUR 1,000, red above EUR 5,000

Worked example

The calculator run on its default inputs:

Data subject requests per month
20 requests
Average handling time per request (minutes)
45 min
Fully-loaded hourly cost of handling staff
€40
Share of complex requests (%)
15%

€780 per month handling DSRs

€9,360/yr

Requests per month
20
Effective handling time per request
59 min (complex ≈3×)
Staff hours per month
19.5
Monthly cost
€780
Annual cost
€9,360

Twenty requests a month at 45 minutes, with 15% complex, gives 45 x (1 + 2 x 0.15) = 58.5 effective minutes (shown rounded as 59). That is 19.5 staff hours a month; at EUR 40 an hour, EUR 780 a month or EUR 9,360 a year.

Sources

Sources last checked September 2026.

Limitations

The figure covers handling time only - not tooling, legal review, or the extra effort of searching systems that are hard to query. The statutory deadlines apply however the cost comes out. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.