§ 53 NDSG
Procedure for the exercise of the rights of the data subject
(1)1The controller shall communicate with data subjects using clear and plain language in a concise, intelligible and easily accessible form. 2Without prejudice to special formal requirements, the controller should, when responding to requests, generally use the form chosen for the request.
(2)Upon receipt of requests for the exercise of data subject rights, the controller shall inform the data subject without undue delay in writing of how the request has been dealt with.
(3)1The provision of information pursuant to § 50, notifications pursuant to specific legal provisions and pursuant to § 42, and the handling of requests pursuant to §§ 51 and 52 shall be free of charge for the data subject. 2In the case of manifestly unfounded or excessive requests by the data subject pursuant to §§ 51 and 52, the controller may either charge a reasonable fee on the basis of the administrative costs or refuse to act on the request. 3In such cases, the controller shall bear the burden of proving the manifestly unfounded or excessive character of the request.
(4)Where the controller has reasonable doubts concerning the identity of the data subject who has submitted a request pursuant to § 51 or § 52, the controller may request from the data subject additional information or evidence necessary to confirm his or her identity.