Subject access requests under the DPA 1998 [Archived]
Subject access requests under the DPA 1998 [Archived]

The following Risk & Compliance guidance note provides comprehensive and up to date legal information covering:

  • Subject access requests under the DPA 1998 [Archived]
  • Code of practice—subject access
  • Right of access to personal data
  • Making a subject access request
  • Requests made on behalf of others
  • Enforced subject access
  • Time limit for responding to a subject access request
  • Locating relevant information
  • Dealing with information about third parties
  • Providing the relevant information
  • more

Sections 7 and 8 of the Data Protection Act 1998 (DPA 1998) set out a data subject’s right of access to personal data held by a data controller. A request for this information is known as a data subject access request (and is also commonly referred to as a ‘SAR’ or ‘DSAR’).

This Practice Note examines SARs and discusses issues to consider when responding to them, including any procedural and administrative requirements, time limits for responding and the best practice guidance from the Information Commissioner’s subject access code of practice.

A data subject is an individual who is the subject of personal data—they may be of any age or nationality for the purposes of DPA 1998, but to qualify as a data subject the individual must be living.

For an explanation of key terms mentioned in this Practice Note, such as personal data, data subject and data controller, see Practice Note: Key definitions under the DPA 1998.

Changes as a result of the General Data Protection Regulation

The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.

For further information, see Practice Notes: The General Data Protection Regulation (GDPR) and GDPR compliance—data subject access rights.

For a