According to the CJEU, the GDPR poses an obligation on a controller to provide the data subject, free of charge, with a first copy of its personal data.