When a US company receives an Article 15 GDPR access request from an EU individual to disclose information the company has processed about them, full compliance could expose its most valuable trade secrets.

This conflict between transparency and secrecy increasingly exposes unprepared US businesses to a dilemma: comply with the GDPR to avoid penalties or do not comply to protect your trade secrets.

Article 15 access requests increased by 222% from 2021 to 2024. Providing no or insufficient information can expose a company to GDPR fines of up to €20 million or 4% of its global annual revenue. Since 2018, GDPR enforcement has resulted in more than €7.1 billion in fines. From 2021 to 2024, U.S. companies specifically faced an average of €1.15 billion in GDPR fines annually. For example, Clearview AI, a U.S. facial recognition company, was fined €30.5 million for failing to respond to two access requests from EU individuals, among other GDPR violations. Likewise, Spotify was fined €5 million in 2023 for failing to provide sufficiently clear information about its personal data processing.

This article provides U.S. tech companies with a strategic and practical framework for navigating GDPR disclosure obligations while protecting their valuable trade secrets.

EU Transparency versus US Secrecy

While the GDPR’s right of access allows individuals to understand how companies process their personal data, trade secret law protects a company’s proprietary information by keeping it secret. However, because a trade secret is only protected as long as it is actually secret, once a company hands over data in an access response, that information may no longer be protected by law; also allowing competitors to freely use it (if they actually obtain it—for example via discovery in litigation).

Given that the GDPR applies to US businesses and the right of access covers not only the personal data but also how that data is processed, distinguishing personal information from proprietary and secret information can be difficult and often impossible, particularly when attempted after the fact rather than as a preventive measure.

For example, an AI hiring company may receive an Article 15 access request requiring it to explain how an applicant’s data was evaluated. However, providing too much detail could reveal trade secrets, such as how its hiring algorithm ranks candidates or which factors receive the most weight. A streaming platform may receive a request asking how a user’s personal data is used to generate personalized recommendations. Responding to the request could risk disclosing confidential recommendation algorithms or methods for predicting user preferences. Likewise, an e-commerce company may receive a request asking why one customer was shown a higher price than another. Explaining the decision could reveal proprietary pricing models, customer segmentation strategies, or other confidential methods used to determine individualized prices.

In SCHUFA (C-634/21, December 2023), the CJEU held that data subjects requesting access to credit-scoring information are entitled to a meaningful explanation of the logic behind automated decision-making. While the Court recognized that trade secrets must be protected, it cannot justify a blanket refusal to disclose relevant information. Similarly, in Österreichische Post (C-154/21, 2023), the CJEU clarified that data subjects have the right to know the specific recipients of their personal data, not merely categories of recipients.

The critical point is that both regimes are legitimate and enforceable, and neither overrides the other in the GDPR context.

What Data and What Processing?

Upon receiving an Article 15 access request, a US company must confirm whether it processes the individual's personal data and must provide access to that data, along with key information about the processing. This includes the purposes of the processing, the categories of personal data involved, the recipients, the applicable retention period (or the criteria used to determine it), the individual's rights to rectification, erasure, restriction, and objection, the right to lodge a complaint with a supervisory authority, the source of the data (where applicable), and the existence of automated decision-making, including profiling.

Article 12 GDPR requires a response without undue delay and within one month of receipt, which may be extended by up to two further months for complex requests. The information must be provided in a concise, transparent, intelligible, and easily accessible form using clear and plain language. The first copy of the personal data must be provided free of charge, and companies must facilitate the exercise of data subject rights and cannot refuse to act unless the controller demonstrates that it cannot identify the data subject.

Trade secrets are defined as information that is secret, has commercial value because of its secrecy, and is subject to reasonable steps to maintain its secrecy. In the tech context, trade secrets commonly include proprietary algorithms, credit and risk-scoring models, recommendation engines, ad-targeting logic, data enrichment pipelines, internal ranking systems, and training data methodologies. For example, in Dun & Bradstreet Austria (C-203/22), a credit-scoring company refused to disclose the logic behind its proprietary scoring model, arguing that doing so would reveal trade secrets. The CJEU clarified that companies must provide meaningful explanations for automated decision-making while balancing the protection of trade secrets.

Practical Strategies for Balancing GDPR and Trade Secret Protection

Resolving the tension between GDPR transparency obligations and trade secret protection requires a careful balancing approach. The goal is to provide data subjects with meaningful information about their data and how it is processed, while limiting disclosure to what is necessary. This requires a proactive system and clear internal processes. The most effective strategy is a layered disclosure model, which means:

Establishing internal systems that provide meaningful but calibrated explanations of algorithmic logic without revealing source code, training data, or other core intellectual property.

Separating personal data from proprietary algorithmic information during system design whenever possible, making future access requests easier to handle.

Using existing industry practices as guidance. Major U.S. tech companies provide useful examples. Companies like Google, Apple, and Meta have developed well-established access request infrastructures, such as Meta’s “Download Your Information.”

Maintaining robust non-disclosure agreements and internal policies that reinforce trade-secret classification and limit exposure risks.

Keeping clear records of what qualifies as a trade secret, why it qualifies, and what protective measures are in place. This documentation is critical for defending refusals before data protection authorities or courts.

Building an internal process to assess each access request for proportionality and balance the data subject’s rights against the company’s legitimate interests.

Furthermore, under the GDPR, a company does not have to comply with requests that are manifestly unfounded or excessive, especially if they are repetitive. However, the burden of proving this rests on the business, and European courts require clear, objective evidence of abusive intent rather than simply a high volume of requests.

Conclusion

GDPR transparency obligations are real and enforceable, but so is the right to protect trade secrets. Neither is absolute. The CJEU has made clear that blanket refusals are insufficient, but calibrated, well-documented responses can satisfy both regimes.

The key message is proactive preparation. If your company processes EU personal data and relies on proprietary algorithms or data-driven systems, now is the time to audit your access-request protocols. Companies that prepare their access-request procedures now will be far better positioned to comply with the GDPR while preserving the trade secrets that underpin their competitive advantage.