August 2026 The Data Protection Commission (DPC) 2025 annual report and case studies show that data subject rights compliance requires more than meeting the one-month deadline, it requires robust governance, clear decision-making and defensible processes. Introduction Data subject access requests continue to present one of the most significant operational and compliance challenges for organisations. The DPC’s 2025 Annual Report (Annual Report) states that by the end of 2025,

July 2026 Appointing a DPO is the easy part. The DPC's Annual Report 2025 makes clear that under-resourcing one is an infringement of the GDPR — and that the DPC is checking. Introduction The Data Protection Commission (DPC) Annual Report 2025 (Annual Report) turns the spotlight on the Data Protection Officer (DPO) — and on the organisations that appoint them. The message is blunt: designation is a starting point, not a defence. Where a DPO is not properly resourced, supporte