Calculates the legal notice period for resignation or dismissal in Ireland, based on your length of service and contract terms.
Free, no sign-up
Calculate →
Data Subject Access Request Deadlines in Ireland
Under the General Data Protection Regulation (GDPR), individuals in Ireland have the right to access their personal data held by organisations. This is known as a Data Subject Access Request (DSAR). When you submit a SAR, the organisation (the data controller) has a legal timeframe within which they must respond. This calculator helps you determine that exact deadline.
How is the SAR Response Deadline Calculated?
The calculation follows a clear rule set out in GDPR Article 12:
- Standard Period: The controller must provide the requested information within one month of receiving your request.
- Clarification or Identification: If the controller needs you to clarify your request or prove your identity, the one-month period only starts once you have provided that additional information.
- Extension for Complexity: If your request is complex or you have made numerous requests, the controller may extend the response period by a further two months. They must inform you of this extension within the first month.
The final deadline is therefore: Start Date + 1 Month + (2 Months if extended).
Worked Example
Imagine you emailed a company your SAR on 10th June 2026. They replied on 15th June asking for a copy of your photo ID to verify your identity. You sent this on 20th June. The company then emailed you on 5th July stating that due to the volume of data involved, they were invoking the two-month extension.
- Effective Start Date: 20th June (when you provided identification).
- Initial Deadline (1 month): 20th July.
- Final Deadline (with extension): 20th July + 2 months = 20th September 2026.
The organisation must respond with your data or a valid refusal by 20th September.
Frequently Encountered Scenarios
- Verbal Requests: SARs can be made verbally. The deadline still applies, so note the date you made the request.
- No Response Before Deadline: If the controller fails to respond by the final deadline, you may complain to the Data Protection Commission (DPC) in Ireland. This is a serious matter and the DPC can investigate and impose fines.
- Weekends & Holidays: The deadline is a calendar month, not a specific number of working days. If the final date falls on a weekend or public holiday, the response is due on the next working day.
- Requests to Third Parties: If you send a SAR to a data processor (like a cloud service provider) instead of the actual data controller, they should forward it to the controller promptly. The deadline still runs from when the controller receives it.
- Fees: In most cases, a SAR must be answered free of charge. A controller can charge a reasonable fee only if the request is manifestly unfounded, excessive, or for further copies. This does not change the deadline.
What Constitutes a Valid Response?
Meeting the deadline isn't just about sending any reply. A valid response typically includes providing the data in a commonly used electronic format if the request was made electronically, or explaining any data that is withheld and the legal basis for doing so. Simply acknowledging the request is not sufficient.
Next Steps: Formalising Your Request
While you can make a SAR informally, using a formal document ensures you provide all necessary details and have a clear record. Our Data Subject Access Request Form is designed for this purpose. After calculating your deadline, consider using this form to submit or follow up on your request. It guides you to include key information like your contact details, the specific data you seek, and any relevant time periods, which can help avoid delays for clarification. Keeping a paper trail with dates is crucial if you need to escalate a complaint to the DPC later.