Data subject access requests 




Workers have a statutory right to access their data by making a written request known as a “data subject access request”. Processing the request must be free of charge (the old £10 fee can no longer be charged). The only exception is where a request is “manifestly unfounded or excessive, in particular because of its repetitive character”, in which case a “reasonable fee” can be charged to reflect administrative costs. There is no need to say why you want the information. The recipient of the request should require you to verify your identity before giving you the information.



The GDPR abolished the old 40-day time frame, replacing it with an obligation to respond “without undue delay” and at the latest within one month of the request. If a request is complex, this time frame can be extended by two more months. There are some grounds for limiting or refusing the request, for example, to avoid obstructing an official investigation. 



Employers cannot refuse a data subject access request on the basis that the person plans to use the information in a legal claim against them (Dawson-Damer v Taylor Wessing [2017] EWCA Civ 74). 


The ICO can bring criminal proceedings against a data controller who alters records to prevent disclosure following a subject access request.