Subject access requests: how do I respond?

How do I respond to a subject access request?

You need to reply to a request for personal information unless an exemption applies.

One of the main rights which the Data Protection Act gives to individuals is the right of access to their personal information. An individual can send you a subject access request requiring you to tell them about the personal information you hold about them, and to provide them with a copy of that information. In most cases you must respond to a valid subject access request within 40 calendar days of receiving it.

Read our guide on the right of subject access

We have also produced specific guidance on subject access requests for some data controllers:

Dealing with subject access requests involving other people's information  
This guidance sets out the main factors you need to consider when you receive a subject access request which involves information that relates to other individuals as well as the individual making the request.

Subject access requests and legal proceedings  
The aim of this guidance is to provide an explanation to legal practitioners and data protection specialists of the ICO's view on the exercise of these access rights where legal proceedings are contemplated or ongoing.

Subject access and employment references   
This guidance clarifies how the Data Protection Act applies to employment references. The recommendations also apply to other types of reference, such as those provided for educational purposes.

Checklist for handling requests for personal information (subject access requests)  
This guidance aims to assist small and medium sized organisations that receive requests for information covered by the Data Protection Act.

Subject access requests and social services records
This guidance is intended to help people who work in social services to deal with subject access requests.

Subject access requests and health record requests by members of the public   
This guidance aims to explain to people who work with medical records how you should deal with these requests and what your responsibilities are under the Act.

Subject access requests and local authority housing records  
This guidance is for professionals who regularly deal with subject access requests for local authority housing records.