Data Subject Access Requests in Ireland: Rights and Obligations (2026)

Under GDPR, every person whose personal data is held by an organisation has the right to request a copy of that data. This is known as a Data Subject Access Request (DSAR or SAR). For individuals, it is one of the most powerful tools for understanding how your data is being used. For organisations, receiving a DSAR creates immediate legal obligations with strict deadlines. This guide explains how DSARs work in Ireland for both individuals and organisations.

What Is a DSAR?

A Data Subject Access Request is a formal request by an individual to an organisation asking for a copy of all personal data held about them, and information about how it is being processed. It is a right granted under Article 15 of GDPR. The right is free of charge (in most circumstances) and can be exercised against any organisation processing your personal data — your employer, a bank, an insurer, a tech company, or any other data controller.

What Must an Organisation Provide?

In response to a DSAR, an organisation must provide:

• Confirmation of whether it is processing your personal data
• A copy of all personal data held about you
• The purposes for which the data is being processed
• The categories of personal data concerned
• Recipients or categories of recipients to whom the data has been disclosed
• The retention period (or criteria used to determine it)
• Information about your other GDPR rights (rectification, erasure, restriction, objection)
• The right to lodge a complaint with the DPC
• The source of the data if not collected directly from you

The One-Month Deadline

An organisation must respond to a DSAR within one month of receipt. This deadline can be extended by a further two months for complex or numerous requests — but the individual must be notified of the extension within the first month, with reasons. Failure to respond within the deadline is a GDPR breach that can be reported to the Data Protection Commission (DPC).

DSARs in Employment

DSARs are increasingly used in employment disputes. An employee who suspects they are being managed out, discriminated against, or treated unfairly can submit a DSAR to their employer requesting all personal data held about them — including emails about them, performance records, disciplinary notes, and HR communications. This can produce significant and sometimes unexpected disclosure.

Can an Organisation Refuse a DSAR?

An organisation can refuse a DSAR in limited circumstances — where the request is manifestly unfounded or excessive (for example, repetitive requests designed to harass). Even then, the organisation must either provide the information or refuse in writing, explaining its reasons and the individual’s right to complain to the DPC.

What If an Organisation Refuses or Ignores Your DSAR?

If an organisation fails to respond to your DSAR within the deadline, or refuses without valid grounds, you can lodge a complaint with the Data Protection Commission (DPC) at dataprotection.ie. The DPC has powers to investigate, order compliance, and impose fines.

Need help submitting or responding to a DSAR? Book a 30-minute consultation with a solicitor at O’Grady Solicitors & Co.. For GDPR compliance generally, see our GDPR Privacy Policy service and our GDPR guide for small businesses.

This article is for informational purposes only and does not constitute legal advice.