Subject access requests: how do I respond?
Subject access is one of the main rights of the Data Protection Act. It gives people the right to access their personal information.
An individual can ask you to tell them about any personal information you hold about them, and to provide them with a copy of that information. In most cases you must respond within 40 calendar days of receiving it.
To find out how to handle a request for information, use our online checklist (takes 1-2 minutes).
Code of practice
Our subject access code of practice provides practical advice on what to do if you get a request from an individual for personal information.
The code answers common questions, provides detailed guidance on how to respond, and also covers exemptions and special cases.
Subject access: code of practice (pdf)
Subject access: code of practice (Welsh) (pdf)
'Access aware' toolkit
Download our posters and other materials to help prompt colleagues to recognise a request for personal information, and know how to deal with it.