Member Services

01 23 777 88

or complete our Contact Form


01 23 777 23

or complete our Contact Form


How to make a subject access request under GDPR

Under Article 15 of the GDPR, you have the right to obtain the following from the data controller:

1. Confirmation of whether or not personal data concerning you is being processed

2. Where personal data concerning you is being processed, a copy of your personal information

3. Where personal data concerning you is being processed, other additional information as follows:

  • Purpose(s) of the processing
  • Categories of personal data
  • Any recipient(s) of the personal data to whom the personal data has or will be disclosed, in particular recipients in third countries or international organisations and information about appropriate safeguards
  • The retention period or, if that is not possible, the criteria used to determine the retention period
  • The existence of the following rights: Right to rectification, right to erasure, right to restrict processing, right to object and information on how to request these from the controller
  • The right to raise a concern with a supervisory authority (in Ireland this is the Data Protection Commission)
  • Where personal data is not collected from the data subject, any available information as to their source
  • The existence of automated decision making, including profiling and meaningful information about how decisions are made, the significance and the consequences of processing


The GDPR states that the right to obtain a copy of your personal data must not adversely affect the rights and freedoms of others. This means that the right cannot be used to access the personal data of other persons, i.e. third parties.

There are also a number of other restrictions to the right of access, provided for by section 60 of the Data Protection Act 2018.

How can I make a request under the Right to Access my personal data?

While the GDPR does not specify any particular format in which you should make an access request, the DPC has provided the below template for access requests that are made to the Data Controller in writing:


I wish to make an access request under Article 15 of the General Data Protection Regulation (GDPR) for a copy of any information you keep about me, on computer or in manual form in relation to...

Be as specific as possible in relation to the personal data you wish to access. You may be asked to provide evidence of your identity. This is to make sure that personal information is not given to the wrong person. Further information on how long it will take, how much it will cost, how the information will be provided, and how to raise a concern with the DPC if you are unhappy with the outcome is available on the website of the Data Protection Commissioner.

From: Data Protection Commissioner website

Share this article!