The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Subject access requests: how do I respond?

Subject access is one of the main rights of the Data Protection Act. It gives people the right to access their personal information.

An individual can ask you to tell them about any personal information you hold about them, and to provide them with a copy of that information. In most cases you must respond within 40 calendar days of receiving it.

Checklist

To find out how to handle a request for information, use our online checklist (takes 1-2 minutes).

Code of practice

Our subject access code of practice provides practical advice on what to do if you get a request from an individual for personal information.

The code answers common questions, provides detailed guidance on how to respond, and also covers exemptions and special cases.

Subject access: code of practice (pdf)
Subject access: code of practice (Welsh) (pdf)

'Access aware' toolkit

Download our posters and other materials to help prompt colleagues to recognise a request for personal information, and know how to deal with it.

Find out more and download the toolkit