What is a subject access request, and how long do you have?

What it is

The right of access in Art 15 UK GDPR lets people confirm whether you process their data and receive a copy, plus the purposes, recipients, retention, source and their rights. A request can be made verbally or in writing, to anyone in the organisation, and need not mention the law. Since the DUAA, the clock stops while you reasonably wait for identity evidence or clarification.

What you must provide

• Confirmation, a copy of the personal data, and the supplementary information. UK GDPR Art 15(1), (3)
• Within one month of receipt, extendable by two months where the request is complex or one of many, telling the person within the first month. Art 12(3); DUAA s.76
• Only what a reasonable and proportionate search would find, but across the whole organisation. Art 15(1A), inserted by DUAA s.78

When you can refuse or withhold

• Requests that are manifestly unfounded or excessive: refuse, or charge a reasonable fee. Art 12(5)
• Information about other people, unless they consent or it is reasonable to disclose without consent. DPA 2018 Sch 2 para 16
• Information covered by an exemption, such as legal professional privilege or crime and taxation, where its test is met. DPA 2018 Schs 2 to 4

Who is responsible

The controller. Processors must help.

What it involves

1. Log the request and its date.
2. Verify identity only where you have genuine doubt.
3. Search reasonably and proportionately, and record the search.
4. Apply exemptions item by item.
5. Respond with the data and the supplementary information.

Timing

One calendar month from receipt; the clock stops while you reasonably wait for identity or clarification.

If it goes wrong

Regulatory

Failing to respond properly breaches Arts 12 to 22. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Most cases start with a complaint to the regulator, which can order compliance.

Criminal

Altering, defacing, blocking, erasing, destroying or concealing information to prevent its disclosure after a request is an offence under DPA 2018 s.173, for individuals and organisations alike.

Civil

The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).