Four data subjects' rights are restricted if their fulfilment would require a disproportionate effort:

Art. 14 V b: “Pararaphs 1 to 4 [information obligation] shall not apply where and insofar as the provision of such information […] would involve a disproportionate effort […].” [see also Rec. 62]

Art. 17 II: “Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of […] the cost of implementation, shall take reasonable steps […].

Art. 19 (1): “The controller shall communicate any rectification or erasure of personal data or restriction of processing […] to each recipient to whom the personal data have been disclosed, unless this […] involves disproportionate effort.”

Art. 34 III c: “The communication to the data subject referred to in paragraph 1 shall not be required if it would involve disproportionate effort.”

In German national law, expenditure and implementation costs may be taken into account in accordance with §§ 22 II 2, 27 II, 28 II, 34 I/IV, 35 I 1/II 2 Bundesdatenschutzgesetz (i.e. Federal Data Protection Act).