Spotlight On The Irish Data Protection Commission’s Annual Report: Data Subject Access Requests

What You Need to Know

On 30 June 2026, the Irish Data Protection Commission (“DPC”) published its annual case studies booklet (“Booklet”) alongside its 2025 annual report (“Report”).¹ This article is the third in our Spotlight on the Report series and focuses on data subject access requests (“DSARs”).²

DSARs again topped the list of complaints made to the DPC accounting for 42% of all complaints. Consistent with our experience of DSARs, the Report notes that DSARs typically have underlying issues at their core, such as employment disputes and poor customer service, rather than data protection concerns.

As DSARs are a major focus of both data subjects and the DPC, it is important that organisations maintain robust DSAR handling procedures. The case studies outlined below provide some practical insight into the DPC’s views on appropriate DSAR procedures.³