Subject Access Request

This document is a subject access request which can be used by an individual to request that an organisation provides information relating to the personal data of the individual that the organisation holds. The document is for use in the United Kingdom. The document can be used by the person who owns the personal data (the data subject), or by a person who is authorised to act on their behalf. The document can be used by any adult individual, including a current or former employee who wishes to obtain information from an employer.

Meaning of personal data

The person in relation whom the personal data is held, or who owns the data, is known as the 'data subject'. When an organisation holds and/or uses a person's personal information, this is called 'data processing'. Personal data is information from which a person can be identified from. Personal data could therefore include things such as:

• A telephone number;
• An email address;
• A postal address;
• Personal bank details;
• An IP address;
• Medical information.

Subject access requests

A subject access request is made in accordance with a data subject's 'right of access' which is held under data protection laws. Most commonly, a person will make this type of request in order to obtain:

• confirmation that their personal data is being processed; or
• copies of personal data which is held In relation to them by an organisation.

As part of their right of access, a data subject also has the right to obtain other supplementary information regarding the processing of their data. The other information which a data subject may request is:

• confirmation as why their data is being processed (the purpose of the processing);
• the categories of the personal data which is being processed;
• who their personal data is shared with;
• how long their personal data will be stored for;
• where their personal data has been collected from;
• information about any automated decision-making;
• written confirmation of their rights to restrict, object, rectify or delete the personal data;
• written confirmation of their right to lodge a complaint with the Information Commissioner's Office (ICO).

It should be noted that, whilst a person may obtain written confirmation regarding their other data protection rights (such as the right to object, rectify, delete or restrict), the purpose of this type of request is to enable the data subject to access the relevant information. Once the data subject has accessed the information, they may then wish to make a further type of request. For example, the data subject may obtain written confirmation that their data is being processed, and then may wish to make an erasure request to ask that the data is deleted.

How to use this document

The document should be signed and sent to the organisation by the person making the request. Where the request is made by a third party who has the authority to act on behalf of the data subject, copies of all relevant evidence to confirm their authority to act should be attached to the request. For example, this may include written consent from the data subject or a power of attorney.

The request can be sent by post or attached electronically to an email. The individual sending the request may wish to keep a copy for their own records.

A written response from the organisation should be provided to the data subject within one month of the organisation's receipt of it. The response should provide the requested information, or otherwise the reasons for any refusal to comply with the request. It is useful to note that there are certain circumstances set out in law which permit an organisation to refuse a request. Where this is the case, the full reasoning should be sent out in the organisation's response. An organisation can, in some limited circumstances, ask that a fee is paid in order to process the request.

If the parties are not in agreement about the response which has been provided by the organisation, there are court remedies available. It is also possible to obtain information, advice and guidance from the Information Commissioner's Officer (ICO) about the use and retention of their personal data.

Applicable law

The UK General Data Protection Regulation

Data Protection Act 2018

Help from a lawyer

You can choose to consult a lawyer if you need help.

The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.

How to modify the template

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.