Irish Data Protection Commission Guidance On Subject Access Requests – Takeaways For Employers

In this second article in our two-part series, Linda Hynes, partner in the Employment, Immigration and Reward team of Lewis Silkin Ireland, looks at the recent guidance issued by the Irish Data Protection Commission ('DPC') on managing subject access requests and considers the key takeaways for employers when dealing with such requests.

As outlined in our previous article on the 2022 DPC annual report, data subject access requests ('DSARs') continue to be a significant source of complaints, representing 42% of the total complaints received by the DPC in 2022. Towards the end of 2022, the DPC issued detailed guidance to data controllers in respect of handling DSARs which employers should carefully review and consider. The guidance closely aligns with the guidelines issued by the European Data Protection Board on the same topic. Both sets of guidelines reflect the extremely high standard to which employers will be held in their handling of employee DSARs.