Start by clicking on "Fill out the template"
Answer a few questions and your document is created automatically.
Your document is ready! You will receive it in Word and PDF formats. You will be able to modify it.
You can choose to get help from a lawyer after filling out the document.
This document is a subject access request which can be used by an individual to request that an organisation provides information relating to the personal data of the individual that the organisation holds. The document is for use in the United Kingdom. The document can be used by the person who owns the personal data (the data subject), or by a person who is authorised to act on their behalf. The document can be used by any adult individual, including a current or former employee who wishes to obtain information from an employer.
Meaning of personal data
The person in relation whom the personal data is held, or who owns the data, is known as the 'data subject'. When an organisation holds and/or uses a person's personal information, this is called 'data processing'. Personal data is information from which a person can be identified from. Personal data could therefore include things such as:
Subject access requests
A subject access request is made in accordance with a data subject's 'right of access' which is held under data protection laws. Most commonly, a person will make this type of request in order to obtain:
As part of their right of access, a data subject also has the right to obtain other supplementary information regarding the processing of their data. The other information which a data subject may request is:
It should be noted that, whilst a person may obtain written confirmation regarding their other data protection rights (such as the right to object, rectify, delete or restrict), the purpose of this type of request is to enable the data subject to access the relevant information. Once the data subject has accessed the information, they may then wish to make a further type of request. For example, the data subject may obtain written confirmation that their data is being processed, and then may wish to make an erasure request to ask that the data is deleted.
How to use this document
The document should be signed and sent to the organisation by the person making the request. Where the request is made by a third party who has the authority to act on behalf of the data subject, copies of all relevant evidence to confirm their authority to act should be attached to the request. For example, this may include written consent from the data subject or a power of attorney.
The request can be sent by post or attached electronically to an email. The individual sending the request may wish to keep a copy for their own records.
A written response from the organisation should be provided to the data subject within one month of the organisation's receipt of it. The response should provide the requested information, or otherwise the reasons for any refusal to comply with the request. It is useful to note that there are certain circumstances set out in law which permit an organisation to refuse a request. Where this is the case, the full reasoning should be sent out in the organisation's response. An organisation can, in some limited circumstances, ask that a fee is paid in order to process the request.
If the parties are not in agreement about the response which has been provided by the organisation, there are court remedies available. It is also possible to obtain information, advice and guidance from the Information Commissioner's Officer (ICO) about the use and retention of their personal data.
The UK General Data Protection Regulation
Help from a lawyer
You can choose to consult a lawyer if you need help.
The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.
How to modify the template
You fill out a form. The document is created before your eyes as you respond to the questions.
At the end, you receive it in Word and PDF formats. You can modify it and reuse it.