Data Subject Access Request Form

Any individual has an unconditional right to request from any organisation within the European Union a copy of all the personal data such an organisation holds about an individual.

This Data Subject Access Request Form allows users to get access to vital information about the personal data an organisation possesses about them. Specifically, the type of data they possess, how they came to possess it, why, and how it is used.

The 'right of access' is one of eight rights granted to data subjects under the GDPR and Data Protection Act 2018.

'Data subjects' are simply any living individuals whose personal data is held or processed by an organisation.

'Personal data' is any information that relates to an identified or identifiable living person, it can be anything from one's name, address, medical information, bank account number or IP address.

The 'right of access' under the GDPR empowers data subjects to learn exactly what information is held about them and the purposes for which it is being processed. Any organisation holding personal data is required under the GDPR to provide a copy of all the personal data they hold about an individual and a several other key pieces of information about their data processing.

This document facilitates the user in vindicating their 'right of access' by setting out clearly the individual's rights under Article 15. The form can be filled in and altered to accommodate the bespoke circumstances applicable to the user. It allows the user to clearly state the specific data they want access to, whether that be all the data concerning them held by the organisation, data generated between certain sets of dates or data concerning a particular event or series of events. The user can then select which information concerning their personal data they want disclosed. This format allows users to solicit the precise information that is relevant for their personal situation and avoid mass disclosures of superfluous information. Users can opt to request access to:

• the purposes for which data is processed;
• the retention period, the source of the personal data;
• the parties who had access to the data;
• any information about automated decision making.

It is important to state one's rights clearly in a Data Subject Access Request to remind the organisation processing the data, that the individual whose data is being held fully aware of and primed to pursue the vindication of their legal rights. Listing clearly the specific data and specific data related information that is sought helps structure the claim and facilitates the swift disclosure of the information by the organisation, which is required by law to provide the information requested within a reasonable time frame and support the exercise of rights.

How to Use the Document

This document should be filled in by an authorised agent of the individual whose data is being held or that individual themselves. It is important to be as accurate as possible in specifying the personal data sought (unless all data held about the data subject is sought) to enable the organisation holding the data to identify and gather it within a reasonable timeframe.

Any living person whose personal data (any information regarding themselves) is held can make a data access request of any organisation who holds or has processed their data. Employees can make the request of employers, contractors of their business partners, customers of any business, users of online services, members of a sports or leisure club, anyone who has had personal information given to or shared with an organisation can make this access request. The document envisages the wide variety of circumstances in which this document may be used. It may be the case that certain information that is optional to include in the Data Subject Access Request Form may not be relevant to a user's specific situation, perhaps a member of a local football club requesting their personal data does not need to know any information about automated decision making, as such the user should read the questions carefully and reflect on their needs when answering.

The document once filled out should be signed by the data subject or their representative and sent to the organisation holding the data. The date on which the Data Subject Access Request is sent should be noted, as the organisation is required to give a response to the request within 30 (thirty) days of receiving it.
It is advised that users keep a hard and soft copy of the document for their records.

In the event this document is served by a representative of the data subject, it is important the data subject sign the document to signal their consent to the representative dealing with the matter of their behalf.

Applicable Law

This Data Subject Access Request Form is designed under Article 15(4) of the GDPR (General Data Protection Regulation) and the Data Protection Act 2018.

How to modify the template

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.