Data subject access requests

Workers have a statutory right to access their personal data by making a written request known as a data subject access request. Processing the request must be free of charge (the old £10 fee can no longer be charged). There is an exception where a request is “manifestly unfounded or excessive, in particular because of its repetitive character”, in which case a “reasonable fee” can be charged to reflect administrative costs. There is no need to say why you want the information or what you propose to do with it. In particular, employers cannot refuse your request because you plan to use the information in a tribunal claim against them (Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74).

The recipient of a subject access request should require you to verify your identity before giving you the information.

The GDPR abolished the old 40-day time frame, replacing it with an obligation to respond “without undue delay” and at the latest within one month of the request. If a request is complex, this timeframe can be extended by two more months. There are some grounds for limiting or refusing the request, for example, to avoid obstructing an official investigation.

The ICO can bring criminal proceedings against a data controller who alters records to prevent disclosure following a subject access request.