Under GDPR (General Data Protection Regulation) a person may request a copy of their personal data. This is refereed to as a Subject Access Request (SAR). State authorities may make a State Authority Access Request (SAAR). These requests must be processed in line with the regulation and within one month of receipt.
Subject Access Requests are often the first step in legal action against organisations. State Authority Access Requests (Gardai, CAB, Revenue) are always in relation to suspected crime. It’s important to have the right policies and processes in place to keep your organisation compliant and avoid mistakes that make be damaging later.