When access requests arrive in volume: what it costs to be wrong

A spike in access requests is not, by itself, a failure. The cost appears when a firm skips triage, gives one requester a different answer from another, or lets the response window run out unnoticed. The safe sequence is short: confirm identity, scope the request, log the clock, and decide extensions on paper — not from memory.

What sets the clock running

Access requests sit inside the applicable data protection framework, not inside a company's internal service-level policy. The framework fixes a response window and allows one extension, but only where a request is genuinely complex or several requests arrive together. Volume on its own does not qualify.

Where the surge follows deployment of an automated decision system, a second layer can apply. Regulation (EU) 2024/1689 (AI Act) enters into force from 2 August 2026, current as at the review date stated below, and adds obligations around explaining automated outputs to the people affected by them.

What changes once the volume starts

Three things change immediately. First, the clock starts on receipt of each request, not on the day someone inside the organisation notices it. Second, one wrong assumption about identity or scope on the first request tends to repeat across the whole batch, multiplying the error rather than containing it. Third, the record of who decided what, and why, becomes the only defence available if a requester later complains.

What to do, in order

Assign one decision-maker for the batch. Do not let each request find its own answer.
Log the receipt date and the clock for every request separately, even where several requests are identical in substance.
Verify identity before reading content, not after. A request answered to the wrong person is a separate failure on its own.
Group requests by scope once identity is confirmed, and answer the group once the scope is settled.
Decide any extension on the file, in writing, before the original window closes, not after it has already run.
Keep a short note of anything withheld, and why, in case the same requester escalates later.

Who decides, and on what

Decision	Who makes it	What it turns on
Whether the request is valid, and from whom	Internal privacy lead	Identity evidence, not the requester's tone
Whether an extension applies	Same lead, recorded on file	Genuine complexity or a genuine batch, not volume alone
Whether a complaint proceeds further	Supervisory authority	The requester's referral against the organisation's own response record
Whether the surge is also a security incident	Compliance and security functions jointly	Whether requests coincide with a breach, not with a marketing campaign

If your situation differs

If several requests arrive from people who left the organisation around the same date, check whether the departures relate to a wider dispute. Where a departing engineer is later named as inventor on a competitor's filing, the questions overlap: When an ex-employee appears as an inventor elsewhere step.

If a request lands mid-migration, the requester's data may sit with a system the organisation is contractually trying to leave. Where a vendor uses that leverage: A migration is blocked by an exit clause technology.

If the organisation behind the request is a token issuer, the data the requester wants may be held by a custodian rather than by the issuer itself: When reserve assets are held by a third party.

If the surge coincides with a sale process, the two clocks run separately, and one does not pause the other: When a change of control triggers termination explained.

If the requests concern an automated decision, such as a scoring model or a filtering tool, the answer must explain the logic involved, not merely list the data held. This sits alongside the data protection framework once Regulation (EU) 2024/1689 (AI Act) enters into force from 2 August 2026, current as at the review date below.

If the volume follows a confirmed breach rather than a routine request pattern, treat the two tracks separately. Incident notification under Directive (EU) 2022/2555 (NIS2) runs on its own timetable and does not wait for the access-request batch to close.

What this page does not cover

This page does not decide whether answering in full requires disclosing content protected under a separate right — for instance, material covered by Directive 96/9/EC on the legal protection of databases. That question is assessed on the file, not on the request alone.

It also does not set the fee, if any, for a repeated or manifestly excessive request. That is a matter for the same internal decision-maker, applied consistently across the batch, not decided request by request.

Verified

Checked against the sources below on 3 June 2025. Where a cited instrument changes after that date, the reference above may need updating before reliance.

Regulation (EU) 2024/1689 (AI Act)
Directive (EU) 2022/2555 (NIS2)
Directive 96/9/EC on the legal protection of databases

Frequently asked questions

What is the first step when access requests arrive in volume?

Assign one decision-maker before answering anything. A batch answered by several people, each applying their own judgement, produces inconsistent responses that are harder to defend than a single, slower, coordinated one.

Which deadline is already running?

The response window starts on receipt of each request, not on the day it is noticed internally. An extension is available only where the request is genuinely complex or the batch is genuinely numerous, and it must be recorded, not assumed.

Who decides, and on what evidence?

An internal privacy lead decides identity, scope and extensions, on the record. A supervisory authority becomes involved only once a requester escalates, and it decides on the organisation's own response file, not on the volume of requests received.