The right of access in Part 3 of the Data Protection Act 2018 is a fundamental right that applies to competent authorities. It is more commonly known as the right to make a subject access request.
It allows individuals to find out what personal data is held about them for law enforcement purposes and to obtain a copy of that data. Following on from our initial guidance on this right, the ICO has now drafted detailed guidance which explains in greater detail the rights that individuals have to access their personal data and the obligations on competent authorities. The draft guidance also explores situations involving joint controllers, how to deal with requests involving the personal data of others and the restrictions that are most likely to apply in practice when handling a request.
At the same time, the ICO has also drafted updated guidance on the provisions in Part 3 on how authorities should deal with manifestly unfounded or excessive requests.
We are running a consultation on both of these pieces of draft guidance to gather the views of stakeholders and the public. These views will inform the published version of the guidance by helping us to understand the areas where organisations are seeking further clarity, in particular taking into account their experiences in dealing with subject access requests since May 2018.
Please submit responses by Friday 11 March at 5pm. Responses submitted after the deadline may not be considered.