- The law
- GDPR articles 12, 15 to 17 and 21
- Who enforces it
- Data Protection Commission (DPC)
- Penalties
- Up to €20 million or 4% of annual worldwide turnover, whichever is higher
What it means for your email
- A subscriber can ask for access to their data, to correct it, to erase it, or to object to direct marketing.
- The DPC says organisations must act "without undue delay" and respond "within one month of receipt of the request".
- The month "may be extended by two further months" where needed because of the complexity and number of requests, and you must tell the person within the first month, with the reasons.
- If you won't act on a request, you must say why within the month, and that they can complain to the DPC or go to court.
- An objection to direct marketing must be acted on: stop emailing them.
Do
- Log each request with a reference and its deadline as soon as it arrives.
- Erase or export the person's data in your email platform and anywhere else email data is kept.
- Keep the minimum on a suppression list so they aren't added back by a later import.
- Record what you did and when.
Don't
- Don't wait for the full month if you can act sooner: the rule is without undue delay.
- Don't send further marketing while dealing with an objection.
- Don't share the person's details with tools that don't need them.
Good to know
- Requests can arrive in any form, including a reply to an email.
- The same rules apply across the EU; the DPC is the regulator for organisations based in Ireland.
Sources
- GDPR (Regulation (EU) 2016/679) (EUR-Lex)
- How long will it take? (Data Protection Commission)
- The right of access (Data Protection Commission)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.