What is a subject access request, and what must an organisation provide?
A right of access under data protection law allowing anyone to ask an organisation what personal data it holds about them, and to receive a copy — and the scope is wider than most organisations expect.
What must be provided:
A copy of the personal data being processed.
The purposes of processing.
The categories of data concerned.
Recipients the data has been or will be disclosed to, including those in other countries.
The retention period, or the criteria used to determine it.
The source of the data, where it was not collected from the individual.
Whether automated decision-making including profiling is used, and meaningful information about the logic involved.
Information about the individual's other rights, and the right to complain to the regulator.
How it works:
No particular form is required. A request can be made verbally or in writing, to any part of the organisation, and does not have to use the words "subject access request" — which is why staff training matters, since a complaint email can constitute one.
No fee in ordinary circumstances.
One month to respond, extendable by two further months where requests are complex or numerous, with the individual informed of the extension and the reason.
Identity may be verified, and the clock pauses while doing so — but the verification must be proportionate.
What is not included:
Other people's personal data. Where a document contains information about someone else, the organisation must either redact, obtain consent, or decide it is reasonable to disclose without it. This is the most common practical difficulty.
Exemptions apply in defined circumstances — legal professional privilege, crime prevention, management forecasting, negotiations and others — and each is narrow and must be justified.
Manifestly unfounded or excessive requests can be refused or charged for, and the threshold is high. Being inconvenient is not a ground for refusal, nor is the requester's motive — including where the request is made in connection with a dispute or employment tribunal, which is extremely common and entirely legitimate.
Opinions about you are personal data, including unflattering ones.
General information, not legal advice.