A pile of old paper files in brown folders

No blanket refusals: what the EU's latest ruling on access requests means for CDOs

Most rulings on subject access requests are about companies. The one the Court of Justice of the European Union handed down on Thursday 5 November is about a regulator. That makes it easy to skip. It shouldn't be, because the reasoning behind it applies to every organisation that holds personal data about people in the EU, and it lands squarely on the desk of the Chief Data Officer.

What the court decided

The case, C-205/25, started with a complaint to the Bavarian data protection authority, the Bayerisches Landesamt für Datenschutzaufsicht. The person who complained later asked the authority, under Article 15 of the GDPR, for the personal data it held about him in its complaint file. The authority said no. It relied on a Bavarian law that ruled out any right of access to supervisory authorities' files and records.

The court disagreed on both points it was asked about:

A data protection authority handling a complaint is a "controller" of the complainant's personal data, so in principle it has to give that person access to their data and the information listed in Article 15.
A national rule that removes the right of access altogether is not allowed. Article 23 of the GDPR lets countries restrict data subject rights, but only with a clear, necessary and proportionate legal basis, not a blanket exclusion.

The court reached the same answer as Advocate General Norkus did in his opinion in April.

Why this matters beyond regulators

Three points in the reasoning are worth reading as instructions for your own access request process.

Access means your personal data, not the whole file. The right of access covers the requester's own personal data and information about how it is processed. It is not a general right to see every document. The Advocate General's opinion says the obligation is to communicate the data, and context where that is needed to understand it, rather than hand over every document that mentions the person. That cuts both ways. You don't have to release internal assessments and drafts as such, but you do have to find every piece of information about the person, wherever it sits.

Other people's data is a reason to redact, not to refuse. One of the reasons the Bavarian authority gave was protecting third parties. The opinion points back to the court's earlier case law: where access conflicts with the rights of others, you weigh the interests, and that weighing cannot justify refusing access completely. Partial disclosure, redaction and anonymisation are the tools. Commentators have already noted that the same logic applies to any company answering a request, so a reply that says "this email thread mentions colleagues and customers, so you can't have it" is hard to defend.

Blanket exemptions in policies are a risk. If a whole category of records is marked "never disclosed" in your access request policy, ask what specific, written legal basis sits behind it. The court's message is that rights can be limited, but only precisely and proportionately.

The UK picture

New rulings from Luxembourg do not bind UK courts, and UK organisations work under the UK GDPR as changed by the Data (Use and Access) Act 2025. The ICO's summary of that Act says organisations only have to carry out "reasonable and proportionate" searches when responding to a subject access request, and they can "stop the clock" while they ask for clarification, as long as they can show it is reasonably required.

So the direction is similar on both sides of the Channel. Access is a right to your own data. It can be managed sensibly, but not switched off.

What CDOs can do now

Map where personal data about requesters lives. Case files, complaint logs, CRM notes, ticketing systems, chat tools and email all count. A good data inventory turns an access request from a scramble into a search.
Separate personal data from the documents that hold it. Build your process around extracting the person's data and enough context to make sense of it, rather than releasing or withholding whole documents.
Make redaction routine. Agree who decides what third-party data is removed, how the decision is recorded, and which tools are used, so redaction is the normal answer rather than refusal.
Review any blanket exemptions. Check your policies for categories of records that are always withheld, and replace them with case-by-case rules tied to a clear legal basis.
Keep the reasoning. Record why searches were limited, why data was withheld and how the balance with other people's rights was struck. That record is what you will need if a requester complains.
Run one playbook with two settings. If you handle data about people in both the UK and the EU, keep a single process with the differences, such as the UK's proportionate search wording, clearly marked.

Access requests are one of the few places where the public sees your data governance working, or not. This ruling is a useful prompt to check that yours answers people properly, even when the file is messy.