In what situations may a controller refuse to provide a copy of processed personal data?

ANSWER

Article 12(4) GDPR provides that the right to obtain a copy of personal data undergoing processing must not adversely affect the rights and freedoms of others. This provision therefore takes precedence over the right to obtain a copy of personal data processed by the data controller.

If the documents contain information that could infringe the rights or freedoms of other individuals, the proposed solution of providing a copy of the data in the form of a printed table will be acceptable. In other cases (those not covered by Article 12(4) GDPR), copies must, in accordance with Article 12(3) GDPR, be provided to the data subject.