[MattBearman]

Although this is a risk, it has been somewhat accounted for in GDPR:

(from ico.org.uk - https://ico.org.uk/for-organisations/guide-to-the-general-da...)

"Can I charge a fee for dealing with a subject access request?

You must provide a copy of the information free of charge. However, you can charge a 'reasonable fee' when a request is manifestly unfounded or excessive, particularly if it is repetitive.

You may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean that you can charge for all subsequent access requests."