Subject access requests: how do I respond?

You need to reply to a request for personal information unless an exemption applies.

One of the main rights which the Data Protection Act gives to individuals is the right of access to their personal information. An individual can send you a subject access request requiring you to tell them about the personal information you hold about them, and to provide them with a copy of that information. In most cases you must respond to a valid subject access request within 40 calendar days of receiving it.

• Read our guide on the right of subject access 

Guidance for data controllers

We have guidance on subject access requests for some data controllers across different sectors and topics.

• Dealing with subject access requests involving other people's information 
  This guidance sets out the main factors you need to consider when you receive a subject access request which involves information that relates to other individuals as well as the individual making the request.
• Access to information held in complaint files 
  This guidance is designed to help organisations deal with requests from individuals who want to access their information, or information about other people, where the information is held in complaint files.
• Subject access requests and legal proceedings 
  The aim of this guidance is to provide an explanation to legal practitioners and data protection specialists of the ICO's view on the exercise of these access rights where legal proceedings are contemplated or ongoing.
• Subject access and employment references  
  This guidance clarifies how the Data Protection Act applies to employment references. The recommendations also apply to other types of reference, such as those provided for educational purposes.
• Checklist for handling requests for personal information (subject access requests) 
  This guidance aims to assist small and medium sized organisations that receive requests for information covered by the Data Protection Act.
• Subject access requests and health record requests by members of the public  
  This guidance aims to explain to people who work with medical records how you should deal with these requests and what your responsibilities are under the Act.
• ACCESS AWARE - toolkit available for download
  The ACCESS AWARE campaign has been designed to help remind staff to be ‘access aware’, helping prompt colleagues to recognise a request for personal information, and know how to deal with it. The toolkit offers a range of free downloadable materials for use within your organisation.