Subject Access Request

How do you obtain documents that you feel identify you (personal information) via the Data Protection Act 1998? You would be considered a data subject under the Data Protection Act 1988 (‘DPA’)

The core of a data subject’s entitlement to access to his personal data is to be found in ss 7(1) and 8(2), which provides:

“7(1) …an individual is entitled –
(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,
(b) if that is the case, to be given by the data controller a description of –
(i) the personal data of which that individual is the data subject,
(ii) the purposes for which they are being or are to be processed, and
(iii) the recipients or classes of recipients to whom they are or may be disclosed,
(c) to have communicated to him in an intelligible form –
(i) the information constituting any personal data of which that individual is the data subject, and
(ii) any information available to the data controller as to the source of those data, and
(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.”.


“8(2) The obligation imposed by section 7(1)(c)(i) must be complied with by supplying the data subject with a copy of the information in permanent form unless-
(a) the supply of such a copy is not possible or would involve disproportionate effort, or
(b) the data subject agrees otherwise.”

The general rule is write to the Data Controller under the DPA enclosing a cheque in the sum of £10.00 and allow them 40 days to provide the information. If you don’t receive it within 40 days then you will need to report the Data Controller to the Information Commissioner.


share this Article

Share on facebook
Share on twitter
Share on linkedin
Share on whatsapp
Share on email

Recent Articles

Overview of IP rights

The pandemic has caused many businesses to invest in selling their goods or services online. This has meant that many businesses have had to invest

Burberry granted injunction against Baneberry

Multi billion-dollar luxury fashion brand Burberry has been granted a preliminary injunction against Chinese copycat brand Baneberry/ The alleged infringers were discovered when Xinboli Trading