Ms Sinéad Gibney:

The one example to put forward is under Article 12 of the GDPR. Data controllers have to respond to a request without undue delay and, at the latest, within one month of receiving the request. Deputy Ward can probably ask the committee's previous guests for more detail on those requests and how they are handled. That is what I am referring to in terms of a specific example one may draw from or a precedent one may take from. We are not suggesting what it might be because we would not have the expertise in terms of what the administrative processes are but I imagine one is talking about maximums of months. It really is looking at what is reasonable within that timeframe and making sure those expectations are heard, understood and held to.