A request for personal data and a request to move information to another service are related, but they are not identical. Naming the outcome clearly helps an organisation understand what is being asked and helps the requester assess the reply.

The Data Protection Commission’s guidance provides the legal starting point. Our contribution is a practical record that keeps the scope, timing and response separate without asking readers to share their personal information with The Press.

Decide what you are asking for

The DPC’s access and portability guidance distinguishes access to personal data from portability. Access concerns whether personal data is processed, a copy of it and information about that processing. Portability concerns a machine-readable copy or transfer under its applicable conditions; it is not a general right to transfer every document held by an organisation.

A useful request identifies the organisation, the personal data sought and any account reference that genuinely helps locate it. A relevant period or interaction can make the scope clearer. Narrowing voluntarily for convenience is a choice, rather than a reason to assume all broader requests are invalid.

Use a reliable contact route

The DPC explains that requests can be written or verbal; a particular form is not mandated by the GDPR. A designated data-protection contact will often be efficient. Verify the organisation’s genuine contact details before sending identifiers or identity documents.

For a written request, keep a copy of the actual message and the date sent. If asking verbally, write a contemporaneous note and seek confirmation of what was understood. Avoid sending a full passport or unrelated records merely because an online example includes them; use the organisation’s verified identity-check process where needed.

Track the response, not just the calendar

The normal response period is one month, without undue delay. A justified extension of up to two further months can apply, with reasons communicated within the initial month. Acknowledging receipt and supplying the requested data are different events.

Use four dated entries: request received; any clarification or identity question; extension notice and reasons; and substantive response. Keep the original scope alongside changes agreed later. This makes it possible to explain a delay without treating every email as a completed response.

Reconcile what came back

Create a short checklist matching the request to the reply: confirmation of processing; data copy; explanation of purposes and recipients; any withheld material and the stated basis; and whether the format can be used. The right is subject to limited restrictions, including other people’s rights, but a blanket refusal should not replace a properly explained assessment.

If something appears missing, identify the gap precisely when following up with the organisation. Retain the exchange if considering a DPC complaint. An access request is a route to personal-data information, not an automatic way to obtain every business record, overturn a decision or prove wrongdoing.