These requests rarely arrive one at a time
When an investment or product runs into difficulty, the advisers who arranged it tend to receive a cluster of requests in a short period. Each client wants the same thing: everything you hold about them.
These are not routine privacy enquiries. They are broad, they are urgent, and the file being asked for is usually years of email rather than a tidy record in one system.
What a client file request actually covers
Broader than most firms expect. It is personal data about the client, not only documents addressed to them.
Email — including internal
Correspondence with the client, and internal email discussing them. Attachments count. So do the threads nobody has opened in six years.
Fact-finds and suitability
Fact-finds, risk profiles, suitability assessments and reasons-why letters — often the documents the request is really aimed at.
Notes and call records
Meeting notes, file notes, call logs and recordings. Informal notes are still personal data.
Provider correspondence
Correspondence with product providers, trustees and platforms that references the client — including where it also references other people.
The clock
You have one month from receipt. Where a request is genuinely complex, or you have received several from the same person, you may extend by up to two further months — but you must tell the client inside the first month and explain why.
Unlike the UK, Irish law has no statutory stop-the-clock. EDPB guidance (Guidelines 01/2022, para. 159) says time may be suspended while you wait for clarification you asked for without undue delay, so ask straight away. Being busy is not a ground for extension.
Responses must be free of charge unless the request is manifestly unfounded or excessive.
The part that catches firms out
You cannot simply forward the mailbox.
An advice file is full of other people's personal data — spouses and family members, colleagues, other clients, named staff at product providers, third parties mentioned in passing in a long email thread. The right to obtain a copy cannot adversely affect the rights and freedoms of others, so that data has to come out before anything is released.
Get it wrong and you have created a second data protection problem on top of the one you were already dealing with. This is the step that turns a request into days of work — and it is why manually redacting several hundred emails is rarely realistic inside a one-month deadline.
If the matter goes further
Where a request arises from a dispute, it is usually not the end of the matter. If it reaches the Financial Services and Pensions Ombudsman, or the courts, how you handled the request becomes part of the record — what you disclosed, what you withheld, on what basis, and when.
Being able to demonstrate that afterwards matters as much as meeting the deadline.
How SAR Portal helps
Take the file as it exists
Upload .msg and .eml emails with their attachments, and SAR Portal converts them to PDF. No re-keying. (Mailbox archive files such as .pst are not supported.)
Find third-party data
Detection across documents, email, spreadsheets, scans and images — including OCR of scanned correspondence and signed forms.
Redact properly
Content is removed from the file, not visually covered over. In the upload flow you review every suggested redaction before anything is applied.
Track the deadline
One-month clock from receipt, with the extension rules built in, across every open request at once.
Handle a cluster of requests
Upload many files to each request at once and see every open request on one dashboard. Bulk archive processing (up to 5 GB or 50,000 files per job) is available on Enterprise.
Keep a defensible record
Every action is recorded in an audit log that no user can edit or delete. For requests made through your portal, the client downloads a secure package, and the log records a SHA-256 hash of each file delivered.
See it with a real request shape
Twenty minutes, walked through with an advice file rather than a canned demo. Built in Ireland, hosted in the EU.
General information on data protection obligations, not legal advice. Consider your own circumstances and take advice where needed.