Data Subject Access Requests

The Subject Access Request [SAR] is the procedure available under Section 7 of the Data Protection Act for an Individual to ask an organisation for copies of personal data held about him/herself whether in manual [e.g. paper-based] or IT filing systems. In DPA terminology, the Subject or Data Subject is the Individual about whom personal data may be held.

An individual may only submit a SAR for him/herself. Proof of identity from the individual is required. A third-party, such as a lawyer, may submit a SAR on behalf of a client subject to the written consent of the client/individual. The Data Protection Act lays down strict timescales for a response to a SAR.

A Court of Appeal ruling on 8th December 2003 has restricted the definition of Personal Data and has curtailed an individual’s rights with respect to a Data Subject Access Request - See Court of Appeal decision elsewhere in this A to Z Guide. These rights have since been partially restored by an amendment to the DPA that became effective in January 2005.

To access your personal data please complete a Subject Access Request Form and return to the Data Protection Office including the necessary proof of identification and statutory £10 fee (as detailed in Section 5 of the form).