4 provisions of the GDPR stipulate that the controller must carry out proportionality checks to determine whether its own data processing is lawful or whether it is not subject to certain obligations:

Art. 5 I c: Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

 

Art. 14 V b: The information obligation shall not apply where and insofar the provision of such information would involve a disproportionate effort.

 

Art. 19 (1): The controller shall communicate any rectification, erasure or restriction of processing to each recipient to whom the personal data have been disclosed, unless this involves disproportionate effort.

 

Art. 34 III c: The communication to the data subject shall not be required if it would involve disproportionate effort.

The term “proportionate” is also used in 9 Recitals: 19, 49, 50, 62, 73, 129, 148, 151 and 152 GDPR.