Under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, you have strong rights over your personal data. These include the right to access the data an organisation holds about you, the right to have inaccurate data corrected, and the right to erasure (the 'right to be forgotten') in certain circumstances. If an organisation misuses your data or ignores your rights, you can complain to the Data Protection Commission (DPC).
⏰ Deadline: An organisation must respond to a data subject request (such as an access or erasure request) without undue delay and in any event within one month of receiving it. This can be extended by up to two further months for complex or numerous requests, and the organisation must tell you if it needs the extension.
✅ What to do
Identify what you want: access to your data, correction of inaccurate data, erasure, or to object to how your data is used.
Make your request in writing to the organisation (the data controller), keeping a dated copy.
Give enough detail to identify yourself and the data concerned, but you do not have to give a reason for an access request.
Wait for the organisation's response — it must reply within the statutory time limit and cannot normally charge a fee.
If they refuse, respond inadequately, or miss the deadline, ask them to reconsider and remind them of their obligations.
If still unresolved, make a complaint to the Data Protection Commission (DPC), including copies of your request and any replies.
In cases of serious harm, you may also be able to seek compensation through the courts.
⚠️ What to watch out for
The right to erasure is not absolute — organisations can refuse where they have a lawful basis to keep the data (for example a legal obligation).
Organisations may seek to verify your identity before acting, which can add time.
Vague requests can be delayed while the organisation asks you to clarify what you want.
Keep evidence of dates — the one-month clock and any complaint depend on when the request was made and answered.
Within one month of receiving your request. They can extend this by up to two more months for complex or multiple requests, but they must tell you within the first month if they are doing so.
Can I always have my data deleted?
Not always. The right to erasure applies in defined situations, but an organisation can refuse where it has a lawful reason to keep the data, such as a legal obligation or the establishment or defence of legal claims.
Where do I complain?
To the Data Protection Commission (DPC), the independent authority responsible for enforcing data protection law in Ireland. Include your original request and the organisation's response, if any.
Do you have a specific document? Upload it and within a minute you will know the deadlines, steps and receive a draft submission. Analyse my document →