Data Subject Access Requests in Ireland: Rights and Obligations (2026)

Last updated 9 October 2026. General information only, not legal advice.

Under GDPR, every person whose personal data is held by an organisation has the right to request a copy of that data. This is known as a Data Subject Access Request (DSAR or SAR). For individuals, it is one of the most powerful tools for understanding how your data is being used. For organisations, receiving a DSAR creates immediate legal obligations with strict deadlines. This guide explains how DSARs work in Ireland for both individuals and organisations.

What Is a DSAR?

A Data Subject Access Request is a formal request by an individual to an organisation asking for a copy of all personal data held about them, and information about how it is being processed. It is a right granted under Article 15 of GDPR. The right is free of charge (in most circumstances) and can be exercised against any organisation processing your personal data — your employer, a bank, an insurer, a tech company, or any other data controller.

What Must an Organisation Provide?

In response to a DSAR, an organisation must provide:

• Confirmation of whether it is processing your personal data
• A copy of all personal data held about you
• The purposes for which the data is being processed
• The categories of personal data concerned
• Recipients or categories of recipients to whom the data has been disclosed
• The retention period (or criteria used to determine it)
• Information about your other GDPR rights (rectification, erasure, restriction, objection)
• The right to lodge a complaint with the DPC
• The source of the data if not collected directly from you

The One-Month Deadline

An organisation must respond to a DSAR within one month of receipt. This deadline can be extended by a further two months for complex or numerous requests — but the individual must be notified of the extension within the first month, with reasons. Failure to respond within the deadline is a GDPR breach that can be reported to the Data Protection Commission (DPC).

DSARs in Employment

DSARs are increasingly used in employment disputes. An employee who suspects they are being managed out, discriminated against, or treated unfairly can submit a DSAR to their employer requesting all personal data held about them — including emails about them, performance records, disciplinary notes, and HR communications. This can produce significant and sometimes unexpected disclosure.

Can an Organisation Refuse a DSAR?

An organisation can refuse a DSAR in limited circumstances — where the request is manifestly unfounded or excessive (for example, repetitive requests designed to harass). Even then, the organisation must either provide the information or refuse in writing, explaining its reasons and the individual’s right to complain to the DPC.

How to Make a DSAR

Address your request to the organisation (many have a data protection officer or privacy contact), say clearly that you are asking for access to your personal data under Article 15 of the GDPR, and give enough detail to help them find it, such as dates, departments or account details. The DPC encourages written requests where practical, and keeping a copy and the date sent helps if there is a later dispute about when the one-month period began. The organisation may ask for proof of identity so that personal information is not given to the wrong person.

The right of access should not adversely affect the rights and freedoms of others, so an organisation may withhold or redact information about other people. The DPC says this should not simply result in refusing to provide all relevant information. Employers dealing with requests may also find our guide to employee data under GDPR useful, and employees raising wider workplace concerns can read our grievance letter guide.

What If an Organisation Refuses or Ignores Your DSAR?

If an organisation fails to respond to your DSAR within the deadline, or refuses without valid grounds, you can lodge a complaint with the Data Protection Commission (DPC) at dataprotection.ie. The DPC has powers to investigate, order compliance, and impose fines.

Need help submitting or responding to a DSAR? This site is not a solicitor’s practice and does not give legal advice. To find a regulated solicitor, use the Law Society of Ireland’s Find a Solicitor directory, or join our no-fee solicitor waiting list. For GDPR compliance generally, see our GDPR Privacy Policy service and our GDPR guide for small businesses.

Frequently asked questions

Do I have to make a DSAR in writing?

No. According to the DPC, the GDPR sets no particular method, so a request can be made in writing or verbally. The DPC encourages written requests where practical, to avoid disputes over the details or timing of the request.

Can an organisation charge me for a DSAR?

In most cases, no. A fee can only be charged if the request is manifestly unfounded or excessive, and the organisation must be able to show this. A reasonable fee based on administrative costs may apply to additional copies.

What should I do before complaining to the DPC?

The DPC advises sending the organisation a reminder if the one-month deadline has passed, and explaining any concerns in writing if the response is incomplete, giving it a chance to reply. If you remain unhappy you can submit a complaint, including copies of your request and any correspondence.

What if the organisation refuses my request?

It must tell you without delay, and no later than one month after receiving your request, giving its reasons and explaining that you can complain to the DPC or seek a judicial remedy through the courts.

This article is for informational purposes only and does not constitute legal advice.