A subject access request has arrived. What you owe, and by when

A subject access request is a request from a person for the personal data you hold about them, made under Article 15 of the GDPR. The Data Protection Commission's guide for controllers says it needs no form and no particular words: the person does not have to mention the GDPR or call it an access request. It can come by email, post, phone, informal chat or in person, to any part of the business, and a solicitor or anybody else can make it for them if they can show the person authorised it.

The DPC's guide says you must give people a dedicated way to make a request, such as an email address shown on your website, or, if that is not possible, name the contact for data protection matters in your privacy notice. A request that arrives some other way still counts, and the DPC expects staff to be trained to recognise one and pass it on.

The guide says to treat anything that may be an access request as one. There are limits at the edges. The guide says a request sent to an address whose automatic reply says nobody reads it might not count. The European Data Protection Board (EDPB), the body of EU data protection regulators, sets limits too. Its guidelines say that a business that has given people a proper channel need not act on a request sent to an address it never gave out, or to a staff member with no part in handling requests, such as a driver or a cleaner. A person's regular contact at the business is not a random address, and a request sent to them counts.

A parent or guardian can make a request for a child, but the right is the child's, and the EDPB makes the child's best interests a leading consideration in every decision on it. Where the authority to ask comes from parental responsibility or a power of attorney, and not from a specific authorisation, the DPC's guide says to consider whether to contact the person first and whether to send the response to them directly.

How a request was written does not decide whether it is one. The DPC's 2025 annual report noted more people using AI tools to help them exercise their rights, and cautioned that this can lead to inaccurate or invalid requests. The test in the guide is whether the person is asking for information related to them that the business cannot simply give in the normal course of business.

The DPC has reprimanded companies for reading requests too narrowly. The DPC's 2025 annual report describes two cases. Patreon said an email to its support address was unclear and sent to the wrong place. The DPC found it was a valid request, and Patreon had answered it only several months later. Cubic Telecom's support contractor mistook an access request for a deletion request and erased the person's data, which the DPC found infringed Article 15.

Access requests are the largest category of complaint the DPC handles. Its 2025 annual report counts 1,280 complaints solely about the right of access, which it puts at 42% of all complaints received that year. It says the majority had another issue at their core, such as a deteriorating relationship between employer and employee, a financial dispute, or something that began as poor customer service.

Article 12(3) requires you to tell the person what action you have taken on the request, without undue delay and in any event within one month of receipt. The DPC's guide says that is a calendar month from the day the request was received, working day or not, and that going past it is a breach in itself.

The guide counts it this way. The period ends at the end of the day in the following month that has the same date as the day the request arrived. Weekends and public holidays count. If that day is a Saturday, a Sunday or a public holiday, the period runs to the end of the following working day. If the following month has no such date, it ends on the last day of that month.

One month is the limit, not the target. The DPC strongly recommends a policy of answering within 15 working days, and its guide says a reply inside the month can still be late if the person's data was due for deletion under your retention policy before you sent it.

Article 12(3) allows the period to be extended by two further months where necessary, taking into account the complexity and number of the requests. You must tell the person within one month of receipt, with the reasons for the delay. The DPC's FAQ says you need neither their permission nor the DPC's.

The DPC's guide gives four situations that may justify an extension: data not readily available on your systems, such as paper files in an archive run by somebody else; retrieval needing resources you do not normally have; considerable redaction of other people's data; or an exemption to assess. It recommends extending as little as possible, and answering what you can now.

Asking the person to narrow the request affects the clock in one case only. Where you hold a large quantity of information about them, Recital 63 lets you ask them, before you reply, to specify the information or processing activities the request relates to. The EDPB says the time may then be suspended while you wait for their answer, and the DPC says you may be entitled to extend. Where you hold no large quantity and cannot rely on complexity, the DPC says the clock does not stop. Either way the person does not have to answer, and you still have to respond if they do not.

Article 12(6) lets you ask for more information to confirm identity only where you have reasonable doubts about who is making the request. The DPC's guide says asking without one can be seen as an obstacle to the right. Its example is an online shop that gets a request for past orders from the email address the customer used to open the account. There is no apparent doubt there, unless something such as a recent hack of the account gives a reason.

Where there is a reasonable doubt, ask at once. The DPC's guide says a request is not effective, and the clock does not start, until identity has been adequately established. The EDPB's guidelines say the time may be suspended while you wait for the answer, but only where you asked for the information without undue delay. Ask for no more than the doubt requires: the DPC suggests security questions drawn from what you already hold, and a copy of ID certified by a member of An Garda Síochána only where there is a proven doubt about the document itself.

The person does not have to say why they want their data. In FT v DW (C-307/22, 26 October 2023) a patient wanted his dental records for a claim against his dentist. The Court of Justice held that the first copy was still free, and that a controller cannot demand reasons for a request. A former employee in a dispute, a customer with a complaint and a solicitor preparing a claim are all making valid requests, on the same clock.

Under Article 15(1) the person is entitled to know whether you process personal data about them. Where you do, they are entitled to access that data and to the information listed below, in the order of points (a) to (h). The DPC's guide says to adapt the privacy notice's wording to this person and this processing, not to paste it in, and its 2025 annual report says organisations must give fuller, more meaningful information when they respond.

On recipients, the Court of Justice held in RW v Österreichische Post (C-154/21, 12 January 2023) that the person is entitled to know exactly who the recipients are, unless they cannot be identified or the request is manifestly unfounded or excessive. Article 15(2) adds the safeguards for any transfer to a third country or an international organisation.

Article 15(3) requires a copy of the personal data undergoing processing. The first copy is free. For further copies you may charge a reasonable fee based on administrative costs. A request made electronically is answered in a commonly used electronic form unless the person asks for something else.

A copy means a faithful and intelligible reproduction of all the data. In F.F. v Österreichische Datenschutzbehörde (C-487/21, 4 May 2023) the Court of Justice held that this can mean extracts from documents, or whole documents, where that is essential for the person to exercise their rights.

You must provide the data you held when the request arrived, including data that is inaccurate and anything inferred or worked out about the person, wherever it sits: emails about them, notes, CCTV footage, entries in a booking or accounts system. The DPC's guide recommends that a person, not only software, does at least the final stages of the search, and gives email moved to the deleted items folder as an example of data that is easy to retrieve. If you keep a record of processing, its activities are a starting list of where to look. It names purposes and categories of data, not every inbox and folder, so search the systems themselves.

Some things are outside it. The DPC's FAQs say backups kept only to restore lost data are not covered, though archives kept for other purposes are. They also say the right does not reach information that is not personal data, or other people's personal data. The EDPB adds that where a backup still holds data about the person that has gone from the live system, the controller should say so and, where technically feasible, provide it. The DPC's guide says data permanently deleted under your retention policy may not have to be recovered with technology you do not have to hand.

Note where you searched and what each search returned. In a 2024 case study, a property management company told a person it held no data about them; when the DPC asked for evidence of its searches, two invoices and an entry in a software system turned up.

A reply that you hold nothing about the person is still a reply under Article 15(1), due within the same month, and the DPC's guide says it is free like any other. Rest it on the searches you noted.

Data that an outside company holds for you (a processor) is still yours to produce. In the DPC's 2025 annual report, Vodafone's processor received five access requests and never passed them on, and the DPC reprimanded Vodafone, the controller. The same case covers the other side. If your business holds personal data for another business, for example as its IT, payroll or booking provider, a request about that data is theirs to answer: the DPC said the processor should have made Vodafone aware of the requests, and Vodafone should have answered them. Under Article 28(3)(e) of the GDPR, the contract between you must oblige you to help them respond.

Article 12(5) makes the response free. Where requests are manifestly unfounded or excessive, in particular because they are repetitive, you may charge a reasonable fee taking into account the administrative costs, or refuse to act. It is up to you to show that the request is manifestly unfounded or excessive.

The DPC sets the bar high. Its guide says a request is unfounded where it plainly does not concern personal data, or concerns data you obviously do not hold. Repetition on its own does not automatically make a request excessive, and nor does the time and effort an answer takes. In a 2023 case study, a medical centre asked a patient for a fee for a first copy. Once the DPC wrote to it, the centre accepted that it should not have asked for the fee.

A change has been proposed and not made. The European Commission's Digital Omnibus proposal of 19 November 2025 would add a ground to Article 12(5): an access request where the person abuses the right for purposes other than the protection of their data. It would also lower the bar for a business, which would need to show only reasonable grounds to believe that a request is excessive. Its recitals say overly broad and undifferentiated requests should be regarded as excessive. On 15 October 2026 the European Parliament's file for the proposal showed it awaiting a committee decision. None of it is law.

Article 15(4) says the right to a copy must not adversely affect the rights and freedoms of others. That includes other people's personal data and, Recital 63 adds, trade secrets and intellectual property. It limits the copy, not the rest of the right, and the DPC says relying on it should not end in a complete refusal. Redact, or blur other people in CCTV footage, and remember that a role, a shift or a payroll reference can identify somebody as well as a name can.

The Data Protection Act 2018 adds restrictions. Several in section 60(3) concern the State, such as national security, defence and money owed to the State. The ones a business can meet are listed below. A dispute with the person does not switch the right off: the restrictions for legal claims apply only as far as they are necessary and proportionate, and the rest of the request still has to be answered.

The DPC's 2025 annual report says organisations relying on exemptions frequently fail to explain why. It recommends a schedule of every document withheld or redacted, with the reason and the provision of the 2018 Act or the GDPR relied on, sent to the person with the response. A documented decision holds up: in a 2025 complaint against Meta, the DPC found no infringement because Meta could explain, with evidence, how it had weighed up the competing rights under Article 15(4).

If you do not act on a request, Article 12(4) requires you to tell the person why, without delay and at the latest within one month of receipt. You must also tell them they can complain to a supervisory authority (in Ireland, the DPC) and go to court (seek a judicial remedy). The DPC's guide applies the same to anything withheld under the 2018 Act. In 2025 the DPC reprimanded Microsoft because, when it refused a person a copy of their data under Article 15(4), it did not tell them they could complain to a supervisory authority and seek a judicial remedy. It also found that deleting the person's data after the request arrived did not comply with Article 5(1)(a).

In this order, because the date and the hold on deletion cannot wait, and the search takes longest.

Plain text, to copy and fill in. They follow Articles 12 and 15 of the GDPR and the DPC's guide. They are not legal advice, and a request with a legal claim behind it is worth a solicitor's reading before the response goes.

The extension notice only works if it reaches the person within one month of receipt. The cover note carries the Article 12(4) information, which is needed whenever anything is withheld.

The DPC's FAQ says a person who has had no response after the month can send a reminder and, at the same time, complain to the DPC. The DPC generally contacts the organisation directly, and its 2025 annual report says that engagement typically leads to resolution without further intervention.

Where it does not, section 109 of the Data Protection Act 2018 lets the DPC serve an enforcement notice requiring you to comply with the request, or issue a reprimand. Under section 133 the notice gives at least 28 days to comply, unless the DPC states that it is urgent, and section 150 lets you appeal against it within 28 days of service. Failing to comply with an enforcement notice without reasonable excuse can lead to an administrative fine under section 133(9). It is also an offence under section 133(10): on summary conviction, a class A fine or up to 12 months' imprisonment or both; on indictment, a fine of up to €250,000 or up to five years' imprisonment or both.

Article 83(5)(b) sets the ceiling for fines over data subject rights at €20 million or, for an undertaking, 4% of worldwide annual turnover, whichever is higher. The access request cases against Patreon, Cubic Telecom, Microsoft and Vodafone in the DPC's 2025 annual report ended in reprimands, with an order to Microsoft to revise its procedures.

The DPC also calls in person. In 2025 it made 13 site visits to organisations that had failed to respond to a rights request or to engage with its complaint process. The premises included restaurants, a GP's surgery, a solicitor's office and the registered business addresses of a number of sole traders. The DPC says the visits are to establish whether a business is still operating, to explain to smaller businesses what their responsibilities are under the GDPR, and to ensure receipt of documents before it considers using its enforcement powers.

The person can also go to court. Section 117 of the Data Protection Act 2018 lets them sue you (a data protection action, treated as an action in tort). Since 11 January 2024 that claim can be brought in the District Court as well as the Circuit Court and the High Court. The court can grant an injunction, a declaration or compensation, and damage includes non-material damage.

Compensation needs damage. In UI v Österreichische Post (C-300/21, 4 May 2023) the Court of Justice held that an infringement of the GDPR alone does not give a right to compensation under Article 82. It also held that non-material damage need not reach a threshold of seriousness. The other statutory dates that run alongside this one are in the compliance clocks.