Data Protection - Subject Access Request Model Form

Summary

This is a model form published by the Office of the Ombudsman for individuals to use when making a Subject Access Request under Section 8 of the Data Protection Act. It is a template document, not binding legal text, intended to help data subjects request access to their personal data held by an organization.

• Requestor details: Name, contact preference, email, phone, and identification within the organization
• Business details: Name of the Business, Organization or Public Authority the request is directed to
• Information that can be requested: Description of personal data held, purposes of processing, recipients or classes of recipients, countries to which data may be transferred, source of the data, and a copy of the personal data itself
• Response timeframe: The organization receiving the request must comply within 30 days, or as prescribed by regulations

The form notes that proof of identity or authorization may be required if acting on someone else's behalf, and directs requestors to the Ombudsman's office for guidance or assistance with making or responding to a request.

Key obligations

• A Business, Organization or Public Authority receiving a subject access request must comply with it within 30 days, or as prescribed by regulations
• A person submitting a request on behalf of someone else must provide documentation authorizing them to do so
• A requestor may be required to provide proof of identity

Applies to

Businesses, Organizations, Public Authorities, data subjects/requestors

Deadlines

• 30 days: Timeframe within which a Business, Organization or Public Authority must comply with a subject access request, or as prescribed by regulations