Dealing With Subject Access Requests
The Data Protection Act 1998 gives individuals the right to access information held about them by organisations. The Act governs how organisations can use the personal information they hold – including how they acquire, store, share or dispose of it.
The Information Commissioner’s Office has published guidance for small- and medium-sized firms on how to deal with requests (called ‘subject access requests’) from individuals for information held about them.
The advice distinguishes between requests that can be treated as part of normal business practice and those that should be dealt with formally under the Act.
If the request can be treated as a routine enquiry, rather than a formal subject access request, it often makes sense to do so. The guidance includes examples of the sort of requests for information that should be handled in this way.
