Making decisions on Data Access Requests