Overview of a SAR
What is subject access?
Enabling individuals to find out what personal data you hold about them, why you hold it and who you disclose it to is fundamental to good information-handling practice. The Data Protection Act 1998 (DPA) gives individuals the right to require you to do this.
This right, commonly known as subject access, is set out in section 7 of the DPA. Individuals may exercise the right by making a written ‘subject access request’ (SAR).
What is personal data?
For information to be personal data, it must relate to a living individual and allow that individual to be identified from it (either on its own or along with other information likely to come into the organisation’s possession). See chapter 5 for more guidance about the meaning of personal data.
Does a SAR have to be in a particular format?
No. A SAR simply needs to be made in writing and, if you require payment of a fee for dealing with the request, to be accompanied by the fee. You may not insist on the use of a particular form for making a SAR, but making a form available may assist the requester to provide the information you need to deal with their request.
How much is the fee?
Unless a SAR relates to one of a small number of special categories of information, the maximum fee you can charge for dealing with it is £10. As from May the 25th 2018 the fee will be nil.