Data Subject Access Requests - FAQ
The majority of the complaints and queries the Data Protection Commission (DPC) receives concern individuals seeking to exercise their ‘right of access’. The General Data Protection Regulation (GDPR), under Article 15, gives individuals the right to request a copy of any of their personal data which are being ‘processed’ (i.e. used in any way) by ‘controllers’ (i.e. those who decide how and why data are processed), as well as other relevant information (as detailed below). These requests are often referred to as ‘data subject access requests’, or ‘access requests’.
These requests must be responded to free of charge and in an accessible form, and controllers should seek to facilitate access requests being both made and responded to easily, including electronically where appropriate and where the individual wishes.
The following guidance should answer some of the most frequently asked questions by both individuals who are seeking copies of their personal data, as well as controllers who are struggling to deal with the access requests they are receiving.
Data Subject Access Requests FAQ - Full Guidance Note
Subject Access Requests: A Data Controller’s Guide
Further reading: