Spotlight on the Irish Data Protection Commission’s Annual Report: Data Subject Access Requests
- Published
- in Industry Updates
What You Need to Know
On 30 June 2026, the Irish Data Protection Commission (“DPC”) published its annual case studies booklet (“Booklet”) alongside its 2025 annual report (“Report”).1 This article is the third in our Spotlight on the Report series and focuses on data subject access requests (“DSARs”).2
DSARs again topped the list of complaints made to the DPC accounting for 42% of all complaints. Consistent with our experience of DSARs, the Report notes that DSARs typically have underlying issues at their core, such as employment disputes and poor customer service, rather than data protection concerns.
As DSARs are a major focus of both data subjects and the DPC, it is important that organisations maintain robust DSAR handling procedures. The case studies outlined below provide some practical insight into the DPC’s views on appropriate DSAR procedures.3
Unfounded DSAR Refusal (Case Study 3)
An independent publisher refused a DSAR on the basis that it was a small company and the DSAR would require an extensive review of records and was therefore manifestly unfounded and excessive. The DPC did not accept the publisher’s position and noted that organisations are required to implement appropriate organisational measures to ensure that they are in a position to respond to any rights requests within the stipulated timeframes under the GDPR.
Key Takeaway: This case is a useful reminder for organisations, particularly smaller organisations, that resource constraints do not justify an outright refusal of a DSAR. Where a request is broad, a phased or interim release of data, combined with proactive engagement with the requester to clarify or narrow its scope, is generally a more defensible approach than refusal and can help resolve matters before they escalate to formal complaints.
Charging a Fee for a DSAR (Case Study 5)
A GP sought to charge an administrative fee for complying with a DSAR for a copy of medical records. The DSAR was a repeat request for the same information and contained no new or additional elements. The DPC confirmed that while DSARs are generally to be handled free of charge, the GP was entitled to charge a fee to cover the administrative costs of handling this repeat request.
Where an organisation considers a request manifestly unfounded or excessive, for example, where an individual submits repeated DSARs for the same information, a data controller may either charge a fee reflecting its administrative costs or refuse to act on the DSAR. The burden of demonstrating this rests with the organisation.
Key Takeaway: This case is a useful example of how the exception in Article 12(5) of the GDPR can be applied. Charging a fee for a DSAR is only permissible in limited circumstances, such as genuinely duplicative requests. Clear documentation for the rationale for any fee charged will be important if the decision is later challenged by a data subject.
DSARs Submitted on behalf of Another Individual (Case Study 6)
A family member, who was one of the primary carers of an individual with additional needs residing in a residential facility, submitted a DSAR seeking a copy of that individual’s personal data. The facility refused to release the records on the basis that the family member did not hold the necessary legal authority to act on the individual’s behalf. Notwithstanding this refusal, the facility arranged a meeting with the family member to discuss the records so that they could remain informed in their caring role, while maintaining its position that copies would not be released absent proper legal authorisation.
The DPC considered the facility’s approach to be appropriate, finding that it had struck the right balance between protecting the data subject’s data protection rights and supporting the family member in their caring capacity.
Key Takeaway: This case demonstrates that a close family member or caring relationship, on its own, does not confer authority to exercise another individual’s data protection rights. Organisations should verify legal authority before releasing records but can still consider alternative ways to engage constructively with carers and family members without compromising the data subject’s rights.
DSAR Refused Due to Deletion (Case Study 9)
An individual complained to the DPC after a hospital refused a DSAR for video footage and an audio file created during their participation in a medical study. The hospital explained that the video footage had been automatically overwritten after two weeks, and that the audio file, while it may still have existed, could not be accessed as the hospital did not have the specialist software required to open it. The complainant also raised that they had not been informed at the time of the study that the video footage would be deleted after two weeks.
The DPC found that the hospital had responded to the DSAR in full since the requested data no longer existed. However, the DPC found that the hospital had not been sufficiently transparent with the complainant regarding the retention periods applicable to the video and audio recordings.
Key Takeaway: This case highlights the importance of transparency relating to the retention of personal data. Ensuring retention periods are clearly communicated to data subjects can prevent issues arising when DSARs are submitted.
Recommended Actions
Across the case studies summarised above, several consistent themes emerge – proactive engagement with data subjects, clear documentation of decision-making and transparency with data subjects. In light of this, we recommend that organisations take the following steps:
- Review and strengthen DSAR handling procedures to ensure that, where a DSAR is broad or resource-intensive, a phased interim release of personal data is considered and requesters are proactively engaged to clarify or narrow the scope, rather than refusing the request outright.
- Establish clear internal guidance on when a DSAR may be considered manifestly unfounded or excessive and ensure that any decision to charge a fee or refuse to act is properly documented, including the rationale relied upon.
- Implement verification steps to confirm that a person submitting a DSAR on behalf of another individual holds the necessary legal authority to do so, while still considering alternative ways to engage constructively on the matter.
- Review data retention periods and ensure they are clearly communicated to data subjects so they understand when their personal data may no longer be available in response to a DSAR.
- Provide regular training to staff who handle DSARs to ensure they are aware of the statutory framework and understand the importance of maintaining clear records of decision-making to demonstrate compliance if challenged.
Further Information
Our Data Protection team is available to assist in reviewing and strengthening data protection compliance frameworks. We would encourage organisations to act now to address any gaps, rather than waiting for a complaint.
For more on the Report, please see our other updates4 and/or visit our knowledge page.5
If you would like to discuss the topics considered here or require any further information, please liaise with your usual Maples Group contact or any of the persons listed below.
1 https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
2 Spotlight on the Irish Data Protection Commission’s Annual Report: Key Findings and Spotlight on the Irish Data Protection Commission’s Annual Report: Practical Takeaways for Employers in Ireland
3 Please see Spotlight on the Irish Data Protection Commission’s Annual Report: Practical Takeaways for Employers in Ireland for an overview of case studies 1, 2, 4, 7 and 8 which concern data subject access requests in an employment context.
4 Spotlight on the Irish Data Protection Commission’s Annual Report: Key Findings and Spotlight on the Irish Data Protection Commission’s Annual Report: Practical Takeaways for Employers in Ireland
