Subject access requests under the DPA 1998 [Archived]

The following Information Law practice note provides comprehensive and up to date legal information covering:

  • Subject access requests under the DPA 1998 [Archived]
  • Code of practice—subject access
  • Right of access to personal data
  • Right of access in relation to automated decisions
  • Making a subject access request
  • Request must be in writing
  • Request to be accompanied by fee (if charged)
  • Request to include sufficient information as to identity
  • Request to include sufficient information as to the information requested
  • Reasonable interval required between similar requests
  • More...

Subject access requests under the DPA 1998 [Archived]

Sections 7 and 8 of the Data Protection Act 1998 (DPA 1998) set out a data subject’s right of access to personal data held by a data controller. A request for this information is known as a data subject access request (and is also commonly referred to as a ‘SAR’ or ‘DSAR’).

This Practice Note examines SARs and discusses issues to consider when responding to them, including any procedural and administrative requirements, time limits for responding and the best practice guidance from the Information Commissioner’s subject access code of practice.

A data subject is an individual who is the subject of personal data—they may be of any age or nationality for the purposes of DPA 1998, but to qualify as a data subject the individual must be living.

For an explanation of key terms mentioned in this Practice Note, such as personal data, data subject and data controller, see Practice Note: Key definitions under the DPA 1998.

Changes as a result of the General Data Protection Regulation

The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.

For further information, see Practice Notes: Introduction to the EU GDPR and UK GDPR and Data

Popular documents