Subject Access Request

The EU General Data Protection Regulation (GDPR) was enacted on 24 May 2016 and comes into direct legal effect in all EU member states, including Ireland, on 25 May 2018.

Under GDPR, personal data is defined “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person“.

Everyone has rights with regard to how their personal data is handled. The Department recognises the need to treat this data in an appropriate and lawful manner.  The Department is committed to complying with its obligations in this regard and in respect of all personal data.

Under the GDPR an individual has the right to request any personal data the Department holds about them, this is known as a Subject Access Request. As part of a Subject Access Request individuals have a right to information on:

The purposes of the processing;

The categories of personal data concerned;

The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine the period;

The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

The right to lodge a complaint with the Data Protection Commissioner

Where the personal data are not collected from the data subject, any available information as to their source;

The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The Department of Public Expenditure and Reform will only accept Subject Access Requests on the form shown here.