When is it due? Access requests and breach reports

Article 12(3) of the GDPR gives you one month from receipt to answer an access request, and lets you extend that by two further months where the request is complex or one of many. The European Data Protection Board says the month is counted under Regulation 1182/71, the EU's rule for periods and dates. In its own examples, a request received on 5 March is due by the end of 5 April, one received on 31 August is due by 30 September because September has no 31st, and a deadline that falls on a weekend or a public holiday moves to the next working day.

The calculator applies those rules with Ireland's public holidays, from the list Citizens Information publishes and, for later years, from the same rules that list follows. The extension can be read two ways, three months from receipt or two months from the end of the first, and where they give different dates it shows the earlier one.

For a breach, Article 33(1) says not later than 72 hours after becoming aware of it. The calculator adds exactly 72 hours, in Irish time, across a change of the clocks if there is one. The Board's guidelines say you become aware when you have a reasonable degree of certainty that a security incident has compromised personal data.