How to make a subject access request in Ireland

Work out which legal entity actually holds your data — the company you dealt with, not its brand name. An organisation’s privacy policy names its data controller and usually gives a data protection officer (DPO) contact; that address is where your request should go. Where none is published, any address the organisation demonstrably reads — info@, its registered office — starts the clock.

Gather what identifies your records: account numbers, customer or policy references, the email address and any previous names or addresses the organisation would know you by. A request that helps the organisation find you gets answered faster.

• the words “subject access request”;
• the legal basis: Article 15 of the GDPR and the Data Protection Act 2018;
• who you are, with the details that locate your records;
• what you want — all your personal data, or specific records if you know exactly what you are after;
• how you want the response delivered.

Asking for “everything” is valid. Being specific where you can — a date range, a department, particular records — tends to get a fuller answer to the part you actually care about.

Copy this, fill in the brackets, and send it — email is fine. Or answer a few questions and our free generator writes it for you, including the on-behalf-of wording this static version leaves out.

[Today's date]

[Organisation name]

Dear Sir or Madam,

SUBJECT ACCESS REQUEST

I am making a subject access request under Article 15 of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 for a copy of the personal data [organisation name] holds about me.

MY DETAILS
Name: [your full name]
Date of birth: [date of birth]
Address: [your address]
Email: [your email]
Account or reference numbers: [any references that help find your records]

WHAT I AM ASKING FOR
Please provide all the personal data you hold about me, in any format and on any system, including emails, letters, notes, call recordings, images and records held by anyone processing data on your behalf.

PLEASE ALSO CONFIRM
- the purposes you are using this personal data for;
- the categories of personal data concerned;
- who you have disclosed it to or will disclose it to, including any recipients in other countries and the safeguards that apply;
- how long you will keep it, or how you decide how long to keep it;
- where you obtained it, if you did not obtain it from me;
- whether you use it for automated decision-making, including profiling, and if so what logic is involved and what the consequences are for me; and
- that I have the right to ask you to correct or erase this data, to restrict or object to its use, and to complain to the Data Protection Commission.

HOW TO RESPOND
Please send the information electronically to [your email address].

I understand that there is normally no fee for this request, and that you must respond without undue delay and within one month of receiving it. If you need anything further from me to confirm my identity, or if you need me to narrow this request down, please tell me as soon as possible so that it can be dealt with quickly.

Yours faithfully,

[Your full name]

The “please also confirm” list is Article 15(1)(a)–(h) and 15(2) — the supplementary information most templates leave out. Keep it in unless you genuinely only want the records; the answers are often the most useful part of the response.

An organisation may ask you to confirm your identity, but only where it has reasonable doubts about who you are, and it should ask for no more than it needs. Where it genuinely needs that information, it can wait for it before acting on your request — so provide it promptly.

An organisation asking for proportionate ID — a copy of a driving licence or passport where sensitive records are involved — is normal. One demanding notarised documents to hand over a copy of your own emails is not; ask it to justify the demand, and mention that you will raise it with the Data Protection Commission if it maintains it.

An organisation must respond without undue delay and within one month of receiving your request. It may extend by up to two further months where requests are complex or numerous, but it must tell you within the first month that it is extending, and why.

There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies of your data.

Diary the date one month out. If the response is late, partial or never comes, the Data Protection Commission route is free and does not need a solicitor. Received a response you suspect is incomplete? Our free response checker walks through what a complete answer contains.