Access to Personal Data

Access to Personal Data

Under the General Data Protection Regulation (GDPR), an individual has a right to access the information that an organisation holds on them. The GDPR provides a formal procedure for individuals to ask for access to, or copies of, their personal data; this is called a Subject Access Request (SAR). See the SAR entry in the A to Z for further information on this process.

The GDPR also requires an organisation that processes any personal data to have in place procedures to control access to that data. The procedures may cover authorisation, authentication,  and the purpose and consent for the processing.