It goes without saying, nevertheless, that in order to be able to comply with this burden, the recipient should have been offered the possibility to provide reasons for his/her request. Regulation 1049/2001 establishes a two-level administrative procedure that gives applicants this possibility. In fact, in cases of access to documents containing personal data, the ordinary course of the procedure under Regulation 1049/2001 implies that if the institution rejects the applicant's initial application invoking the exception relating to personal data protection, the applicant is then entitled to submit a confirmatory application and put forward grounds in order to demonstrate the necessity for the requested data to be transferred to him. Subsequently, the institution has to decide on the confirmatory application, after having proceeded to the balancing exercise required by Article 8(b) of Regulation 45/2001.