Thank you. If an organisation holds personal data about an individual, section 7 of the Data Protection Act 1998 entitles that person to request copies of such data. The process is known as a Subject Access Request (SAR).
If a SAR needs to be made, the individual needs to write to the organisation which holds the data in question. It would be useful to check if there is a dedicated data protection officer to whom such requests need to be addressed. If not, it can be sent to their general correspondence address. The SAR letter should include the following information:
· Make it clear that a 'subject access request under section 7 of the Data Protection Act 1998' is being made
· Provide details of the data for which copies are requested, together with any information necessary to locate it.
· The individual’s main personal details - full name, date of birth, address and contact number
· Copy of any identification to identify the individual, such as passport or driving licence
· A cheque or postal order for £10 to cover the maximum amount they may charge for the provision of these documents
Once the formal request has been correctly made, the organisation must respond within 40 days.