Subject Access Request

This document is a letter which can be used to make a formal request to obtain personal information held by an organisation. This type of request is called a subject access request.

The person in relation to whom the personal data is held, or who owns the data, is known as the data subject. When an organisation holds and/or uses a person's personal information, this is called 'data processing'.

Personal data is information from which a person can be identified. Personal data could therefore include things such as contact details, bank details, medical information or employment records.

A subject access request is made in accordance with a data subject's right of access which is held under data protection laws. Most commonly, a person will make this type of request in order to obtain:

• confirmation that their personal data is being processed; or
• copies of personal data which is held In relation to them by an organisation.

As part of their right of access, a data subject also has the right to obtain other supplementary information regarding the processing of their data. The supplementary information may include:

• confirmation as to why their data is being processed (the purpose of the processing)
• the categories of the personal data which is being processed
• who their personal data is shared with
• how long their personal data will be stored
• where their personal data has been collected from
• information about any automated decision-making
• written confirmation of their rights to restrict, object, rectify or delete the personal data.

Once the data subject has accessed the information, they may then wish to make a further type of request. For example, the data subject may wish to make:

• an erasure request to ask that the data is deleted.
• A rectification request to ask that an error in the data is corrected.

How to use this document

The document should be signed and sent to the organisation. The request can be signed and sent by post or electronically signed and sent via email. Where the request is made by a third party who has the authority to act on behalf of the data subject, copies of all relevant evidence to confirm their authority to act should be attached to the request. For example, this may include written consent from the data subject or a power of attorney.

A written response from the organisation should be provided to the data subject within 28 days of the organisation's receipt of it. The response should provide the requested information, or otherwise the reasons for any refusal to comply with the request. It is useful to note that there are certain circumstances set out in law which permit an organisation to refuse a request. Where this is the case, the full reasoning should be sent out in the organisation's response. An organisation can, in some circumstances, ask that a fee should be paid in order to process the request.

If the parties are not in agreement about the response which has been provided by the organisation, there are court remedies available. It is also possible to obtain information, advice and guidance from the Information Commissioner's Officer (ICO) about the use and retention of their personal data.

Applicable law

The UK General Data Protection Regulation

Data Protection Act 2018

Help from a lawyer

You can choose to consult a lawyer if you need help.

The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.

How to modify the template

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.