Data subject access

The data controller’s duty to provide information in response to a request from an individual in relation to his or her personal data is covered in the next chapter. This is similar to a “subject access request” under the DPA but with a number of changes including that information provided in response to such requests under the GDPR must generally be provided free of charge.

Note that controllers should not retain personal data just so that they can respond to data subject requests.