Applying Under the Data Protection Act


The person holding information about you is called the data controller. To apply for access to any personal data about yourself, write to the data controller, saying that you are applying under Section 7 of the Data Protection Act. Sending your request by recorded delivery will help avoid any later dispute about whether it was received.

If the data controller has different offices or branches and you are not sure which to write to, telephone first and ask. Alternatively, contact the Information Commissioner’s office or look at the data controller’s register entry, which can be found on the Internet at: www.informationcommissioner.gov.uk

Organisations must register under the Data Protection Act and provide an address for subject access requests in their register entry. The register entry must also specify the purposes for which information is held. A data controller must not hold or use the information for purposes incompatible with those stated in the register entry.

Before supplying information, the data controller is entitled to ask you for proof of your identity and for any further details needed to locate data held about you. It may help if you say what your relationship to the organisation is (for example, customer, employee, student, patient), give any relevant dates or reference numbers and say which of its offices or branches you have dealt with - but don’t volunteer any information you regard as confidential or private. You do not need to say why you want the information. The data controller cannot refuse access because you might use the data to criticise the controller, complain or take legal action.

You may have to pay a fee. At the time of writing the maximum fee is £10, however, some organisations charge less or nothing. If information is held about you in both computer form and in structured paper files, a single £10 fee covers both. Different rules apply to educational records and manual health records, where you could be charged up to £50 - including the cost of all photocopies - and credit reference agency records where the maximum fee is £3.

The data controller must normally give access within 40 days of receiving your request and any supplementary details needed. It must supply the information in permanent form. This normally means a print-out or a photocopy, but could also include copies of microfiches, X-rays, or audio/video cassettes. Any unintelligible terms, such as computer codes, must be explained.

The data controller can refuse to supply a permanent copy of the data if this is not possible or would involve disproportionate effort. You are still entitled to inspect the information at the data controller’s premises.
kitsiteLottery Funded