How to File a Subject Access Request (SAR) in Ireland (Free Letter Template)

Most ordinary citizens dread receiving official or corporate letters. However, when a business, insurance company, or state institution receives a Subject Access Request (SAR)—also known as a Data Access Request—the tables completely turn. [1]

Alarms go off inside their offices. Meetings are called, emails fly, and staff must scramble to comply. Issuing a SAR demonstrates that you understand your legal rights and are holding the organisation accountable to the law. Under data protection law, they cannot ignore you.

Below is a plain-English guide on how a SAR works, why it is your most powerful tool, and how to download a free, editable letter template to send to your opponent.

⚡ Why a Subject Access Request is So Powerful

A SAR is not just a polite request for information; it is a legally binding demand backed by the General Data Protection Regulation (GDPR) and the Irish Data Protection Commission (DPC).

1. The 30-Day Clock: Organisations have exactly 30 calendar days to comply. There are no excuses and no delays. Failing to respond is a serious legal breach that can result in heavy regulatory fines.
2. Exposes Internal Secrets: They must hand over everything containing your personal data. This includes hidden internal emails, call recordings, performance notes, memos, and files where they discussed you behind closed doors.
3. Creates an Undeniable Paper Trail: Every document, email thread, or record they give you can be used as hard evidence to prove your case in court or during a formal dispute.
4. Forces Settlement Talks: When massive firms (such as major solicitors, global insurers, or corporate entities) realize they must expose their messy internal communications, their tone shifts instantly from ignoring you to trying to settle with you.

📋 How to Use a SAR Effectively

To ensure your request is bulletproof and cannot be brushed aside by a corporate legal team, follow these rules:

1. Use the Magic Words: State explicitly in the subject line and body that this is a “Subject Access Request under Article 15 of the GDPR”.
2. Verify Your Identity: Provide enough specific details (such as account numbers, reference numbers, or a copy of your ID) so they cannot use “identity verification” as a tactic to stall their 30-day deadline.
3. Cast a Wide Net (But Be Specific): Demand all personal data held about you across every department, but explicitly highlight key items you want—such as “all internal emails discussing my case between Date and Date
4. Send via Trackable Methods: Never send a SAR by standard post. Use Registered Post or a secure email address that provides an automatic delivery receipt. Keep a complete copy for your files.
5. Count Down the Days: Mark the 30-day expiration date on your calendar. If they fail to provide your files by day 31, immediately log a formal complaint with the Data Protection Commissioner.

📥 Free Document Download

Click below to download an editable Word document template to draft your own data access demand:

Download Sample Subject Access Request (SAR) Letter Template (Official Template framework aligned with Data Protection Commission guidelines)

Disclaimer: This page provides general informational templates for ordinary citizens exercising their data rights. It does not constitute formal legal advice. While data protection laws are highly robust, certain narrow exemptions exist regarding data that is strictly covered by legal professional privilege.