What supporting documents may be required when you raise a concern with the DPC?
29th August 2019
Since the introduction of the GDPR, we’ve seen a huge increase in the number of people contacting the Data Protection Commission (DPC), as individuals become more aware of their data protection rights. With this in mind, it’s important to know what supporting documents you should include when you contact us with a query or a complaint.
If you are contacting the DPC with a query or issue relating to access requests, erasure requests or rectification requests, then there are a number of things we will ask you for, so it’s recommended you include these when you first contact us:
- The original request you sent to the organisation – this is important to include so that we can see exactly what you requested;
- The reminder letter or email about your request to the organisation, if you have sent one;
- The response you received from the organisation, as well as any other correspondence you have had with the organisation in relation to the request you submitted to them;
- Where an advocate/representative has made the contact on behalf of an individual, signed authority from you for this;
- Any other relevant correspondence on the matter; for example, if the data controller has sought proof of your identity, evidence that you have provided same;
- If applicable, a copy of any letter sent to the organisation outlining the specific personal data that has not been provided;
- If applicable, a copy of any letter sent to the organisation seeking an explanation for the reliance on any exemption to a data protection right, together with any reply received from the organisation, and your views in writing as to why the exemptions being relied on by the organisation are not validly applied;
- Details of the specific data protection issue you are raising; and
- Documentary evidence to support any allegation being made.
It’s important to remember that we at the DPC cannot make a request for access/rectification/erasure on your behalf. You should assert your data protection rights on your own behalf initially by making the request. Then, if you don’t receive a response to the request or if you’re dissatisfied with any response received, you can bring the matter to the attention of the DPC.
If you’re contacting us about a direct marketing issue, make sure to include the direct marketing material you received and any correspondence you have had with the organisation if you contacted them to opt-out of their direct marketing material.
Remember, if you provide all the required supporting documents up front, it can assist with speeding up the process, as it removes the need for us to come back to you to request the information.
For a full list of the information required to when raising a concern with the DPC, read our guidance on evidence that may be required.