Subject Access Request Ireland

A subject access request — a SAR, or DSAR — is you asking an organisation for a copy of the personal data it holds about you, together with information about how it is using that data.

In Ireland the right comes from Article 15 of the GDPR, which applies directly, with the Data Protection Act 2018 giving it further effect in Irish law. Any organisation processing your personal data is covered — companies, public bodies, employers, landlords, schools, clubs.

You do not need a solicitor, a form or a reason. A written request that makes clear who you are and what you want is a valid SAR, however it is phrased.

A copy of your personal data in any format the organisation holds it: emails and letters about you, account and file notes, complaint records, HR records, call recordings, CCTV footage of you, and records held by anyone processing data on the organisation’s behalf.

Article 15 also entitles you to supplementary information most people never ask for — the purposes the data is used for, the categories held, who it has been disclosed to (including abroad), how long it will be kept, where it came from if not from you, and whether it is used for automated decision-making or profiling. The answers are often more revealing than the records.

Write to the organisation — its data protection officer if it has one — say you are making a subject access request, identify yourself, and say what you want. Email is fine. How to make a subject access request in Ireland walks through it step by step, including template wording.

Or answer a few questions and let our free letter generator write the letter for you, with the Irish legal citations already in place. It is free, complete and yours to send.

An organisation must respond without undue delay and within one month of receiving your request. It may extend by up to two further months where requests are complex or numerous, but it must tell you within the first month that it is extending, and why.

There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies of your data.

An organisation may ask you to confirm your identity, but only where it has reasonable doubts about who you are, and it should ask for no more than it needs. Where it genuinely needs that information, it can wait for it before acting on your request — so provide it promptly.

You can send a SAR to any organisation that holds data about you. Two of the most requested have their own guides:

• HSE and medical records — including when the Freedom of Information Act 2014 is the better route, and how GP and private records differ.
• An Garda Síochána — Garda records run under different provisions of the Data Protection Act 2018, and vetting is a separate process entirely.

Requests to Revenue, the Department of Social Protection, banks, insurers and employers all follow the standard GDPR process this page describes.

Most organisations respond inside the month once a clear request lands in the right place. When one does not, escalation is free and effective.

Raise it with the organisation first — its data protection officer, if it has one, is the right address. If that gets you nowhere, Article 77 of the GDPR gives you the right to lodge a complaint with the Data Protection Commission, which supervises data protection law in Ireland.

The Data Protection Commission: when and how to complain covers the process.

Since Brexit, the UK runs its own amended “UK GDPR”. The rights look alike but the texts have diverged — the UK version now limits organisations to a “reasonable and proportionate search”, a limit the GDPR that applies in Ireland does not contain, and the two escalation routes are different regulators.

Requesting from a UK organisation instead? Our UK service and GDPR in Ireland set out each side. Where an organisation operates in both countries, send your request to the entity you actually deal with.