Subject Access Request Response Pack

When an individual makes a Subject Access Request (DSAR), you have one month to respond. A non-compliant response — whether incomplete, late, or incorrectly refused — can result in a DPC complaint, investigation, and potential fine.

What Is a DSAR?

A Data Subject Access Request is a request by an individual (an employee, customer, or any other person) for a copy of the personal data you hold about them. Under Article 15 of GDPR, you must respond within one month, provide a copy of the data, and explain how it is used.

What We Do

Our DSAR response pack includes: a consultation to understand the scope of the request, advice on what data must be provided and what can legitimately be withheld (third-party data, legal professional privilege, disproportionate effort exemption), preparation of the response letter, redaction guidance for documents to be disclosed, and advice on any refusal grounds if applicable.

Common DSAR Issues

Common problems with DSAR responses include: responding late (outside the one-month window), providing incomplete data, incorrectly applying exemptions, failing to provide the required supplementary information, and disclosing third-party data without redaction. Each of these can result in a DPC complaint.

What Our Clients Say

“Received a DSAR from an ex-employee. The solicitor helped us identify exactly what we needed to provide, what we could withhold, and how to respond correctly. No DPC complaint followed.”

“Had never received a DSAR before and didn’t know where to start. The response pack covered everything and we responded on time and in full.”

“Professional, clear guidance on a DSAR that could have been complicated. The response was delivered well within the one-month window.”

Frequently Asked Questions

How long do I have to respond to a Subject Access Request in Ireland?

You must respond to a DSAR within one month of receipt. The period can be extended by two months for complex or numerous requests, but you must notify the individual within the first month of the delay and the reason for it.

Can I charge a fee for responding to a DSAR in Ireland?

Generally no — DSAR responses must be provided free of charge. An exception applies where requests are manifestly unfounded or excessive (particularly if repetitive), in which case you can charge a reasonable fee or refuse.

What data must I provide in response to a DSAR?

You must provide a copy of all personal data you hold about the individual, together with: the purposes of processing, the categories of data, recipients or categories of recipients, retention periods, the source of the data if not collected directly, and information about any automated decision-making.