You're redesigning your privacy notice. Your legal team wants to list a phone number for rights requests. Your customer service team suggests using your existing premium-rate line to handle the volume. It feels like an operational decision, but it's also a regulatory one.
The Spanish supervisory authority's €100,000 fine against Securitas Direct shows why. The company directed data subjects to a chargeable 902 number to exercise access and objection rights. Even though free channels existed elsewhere on their website, the video surveillance notices pointed people to the paid line. That single design choice violated Article 12(2) of the GDPR.
Here's how to avoid the same mistake.
The Decision You're Facing
When setting up contact mechanisms for data subject rights requests, you choose between several channel types:
- Premium-rate or chargeable phone lines
- Standard-rate phone numbers
- Email addresses
- Web forms
- Postal addresses
- In-person contact points
Each has different cost implications for your organization and the data subject. Article 12(2) requires you to "facilitate the exercise" of rights under Articles 15-22. "Facilitate" means you can't create financial or procedural friction that discourages requests.
Key Factors That Affect Your Choice
Where the contact point appears. If your privacy notice, CCTV signage, or data collection form lists a specific channel, you're directing people to use it. The Securitas case turned on this: the video surveillance notices specifically referred data subjects to the 902 number. The existence of free alternatives didn't matter because the notice itself created a cost barrier.
Whether you charge the data subject. Article 12(5) allows a "reasonable fee" only when requests are manifestly unfounded or excessive. You can't front-load costs by making the initial contact chargeable. A 902 number costs the caller money, creating a barrier.
How prominent the channel is. If you list five contact methods but bury the free ones in a footnote while highlighting a paid number, you're still hindering the exercise of rights. Supervisory authorities assess the practical reality, not just the theoretical availability of compliant options.
Your data subject population. If you're processing data about vulnerable groups, children, or people with limited resources, even small cost barriers carry more weight. The Spanish supervisory authority didn't need to prove anyone was actually deterred. The existence of the barrier was enough.
Path A: When to Use Premium-Rate or Chargeable Lines
Don't.
There's no compliant scenario where you direct data subjects to a chargeable phone line to exercise their GDPR rights. The Securitas decision makes this explicit. Even if you offer free alternatives, listing a paid number as the contact point for rights requests violates Article 12(2).
If you currently use premium-rate numbers for general customer service, that's fine. But your privacy notice and data collection materials must point to a free channel for rights requests.
Path B: Standard-Rate Phone Numbers and Email
This is your baseline compliant option.
Use standard-rate phone numbers where the data subject pays only their normal carrier charges. No premium. No per-minute fees beyond what they'd pay for any local or national call.
Provide an email address that's monitored and responded to within Article 12(3)'s one-month deadline. Generic addresses like [email protected] work. Avoid addresses that require the data subject to have an existing account or login.
Add a web form if you want structured intake. Don't require account creation to submit. Don't charge for form submission or processing.
When to choose this path:
- You're a controller of any size handling routine volumes of rights requests
- You need a scalable intake mechanism
- You want to avoid the procedural overhead of postal handling
Practical step: Audit every document where you collect personal data or notify people about processing. Check that the listed contact method for rights requests is free at the point of use.
Path C: In-Person and Postal Channels
Article 12(2) doesn't prescribe specific channels. You can offer in-person contact points or postal addresses, provided they don't create undue barriers.
In-person channels work when:
- You operate physical locations where data subjects already visit (retail, offices, service centers)
- You have staff trained to handle rights requests on-site
- You provide this alongside, not instead of, remote channels
Don't require in-person attendance if your processing relationship is entirely digital. A data subject who interacts with you only through your app shouldn't need to visit a branch to exercise their rights.
Postal addresses are acceptable when:
- You list them alongside electronic channels
- You don't require notarization, witnessed signatures, or other procedural hurdles that add cost
- You respond within Article 12(3) timelines despite postal delays
The risk: If postal response times push you past the one-month deadline, you've created a practical barrier even if the channel itself is free.
When to choose this path:
- You're supplementing, not replacing, electronic channels
- Your data subject population includes people with limited digital access
- You want to offer choice without creating compliance gaps
Summary Matrix
| Channel Type | Compliant? | When to Use | Risk Level |
|---|---|---|---|
| Premium-rate phone | No | Never for rights requests | High, direct violation of Article 12(2) |
| Standard-rate phone | Yes | Any controller, any volume | Low, if monitored and resourced |
| Email address | Yes | Primary channel for most organizations | Low, ensure one-month response |
| Web form | Yes | High-volume intake, structured data collection | Low, don't require account login |
| In-person | Yes, with conditions | Physical locations, alongside remote options | Medium, training and documentation required |
| Postal address | Yes, with conditions | Supplementary channel, not sole option | Medium, timeline management critical |
What This Means for Your Audit
Review your current materials with three questions:
What contact method do we list in our privacy notices? If it's a chargeable number, you're exposed. Replace it with a free channel within your supervisory authority's corrective action timeline. The Spanish supervisory authority gave Securitas 12 months.
Do we offer free alternatives but highlight paid options? Prominence matters. If your CCTV signage, app interface, or website footer lists the 902 number first and the free email in small print, you're still hindering the exercise of rights.
Can we demonstrate that data subjects know how to reach us for free? Document your intake channels. When a supervisory authority investigates, you'll need to show not just that free options exist, but that data subjects are clearly directed to them.
The Securitas fine wasn't for blocking rights requests entirely. It was for making them harder. That's the standard you're held to: active facilitation, not passive availability.
