IrelandA company won't respond to my data access request.
Under Irish law, a company must respond to your data access request within one month. If they fail to do so, you can complain to the Data Protection Commission.
What the Law Says
The Data Protection Act 2018 gives effect to the EU General Data Protection Regulation (GDPR) in Ireland. It sets clear obligations on companies that hold your personal data — including the duty to respond promptly to your request to access that data.
If you make a valid data access request (also called a Subject Access Request or SAR), the organisation must respond without undue delay and in any event within one month of receiving the request. This deadline can be extended by two further months where the request is complex or numerous — but only if the organisation informs you within one month and explains why the extension is necessary.
The response must be in writing (or electronic form, if requested) and include all personal data held about you, along with key information such as the purposes of processing, categories of data, recipients, retention periods, and your rights to rectification, erasure, and restriction.
If the company refuses your request or fails to respond, it must give you clear reasons — and inform you of your right to lodge a complaint with the Data Protection Commission (DPC) and to seek a judicial remedy.
Statutory TextA controller shall respond to a request under section 49(1) without undue delay and in any event within one month of receipt of the request.
— Data Protection Act 2018, s. 51 — Duty to respond to requests
What to Do
Send your request again in writing (email or letter), clearly quoting GDPR Article 15 and Data Protection Act 2018, s. 49–51, and noting the original date of your first request.
Wait until the full one-month deadline passes (counting calendar days from the day after receipt).
If still no response, submit a formal complaint to the Data Protection Commission online at dataprotection.ie — it’s free and takes <10 minutes.
Keep copies of all correspondence and note dates — this supports your complaint.
If the DPC finds a breach, the company may face enforcement action, including fines up to €20,000 (for summary conviction) or higher under GDPR.
Sources
Same Question, Other Jurisdictions
Germany
Canada
Australia
Singapore
European Union
India
UK
US-California
JapanNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.