The case law recognizes that there are barriers to the right of inspection. For example, a controller is not required to provide access to:
Legal analyses or documents, in which (often sporadically) the person's name appears (ECJ EU 17 July 2014, ECLI:EU:C:2014:2081) and/or
Personal internal notes taken by employees that are not intended to be included in a file and are therefore purely for internal consultation (e.g., Amsterdam Court of Appeal July 5, 2011, ECLI:NL:GHAMS:2011:BR3020; HR June 29, 2007, ECLI:NL:HR:2007:AZ4663, ECLI:NL:HR:2007:AZ4664, ECLI:NL:HR:2007:BA3529).
If as an organization you process a lot of personal data or the data subject's request is not completely clear, you have the right to ask him/her for clarification/specification of his/her request. Please note that you have a period of up to one month to provide a substantive response to the data subject (this period can be extended under strict circumstances). This is counted from the moment the request is received by your organization, even if you have asked for clarification in the interim.
It is not permitted to charge the data subject. This is allowed only in exceptional cases, such as when a data subject requests additional copies or makes an excessively extensive request.
In addition, as an organization, you must almost always obey a discovery request. However, there are some exceptions:
If a data subject makes repeated (the same) requests;
Part of the file is about another person involved;
There is a legal ground for not granting access to the data subject (pursuant to Art. 41 UAVG): e.g. for the protection of public security, to prevent or detect crimes or to protect the rights and freedoms of others.
If you decide not to comply with a request for access, you will always have to inform the data subject with reasons within a maximum of one month. In doing so, you must inform the data subject of his or her right to file a complaint with the AP or appeal to the Court.
Source: DMCC
