Template Letter for Right of Access Request

Summary

This is a template letter published by the JOIC to help individuals in Jersey exercise their right of access (subject access request) under Article 28 of the Data Protection (Jersey) Law 2018. It is a drafting aid, not binding guidance, and must be adapted to the individual's circumstances before use.

• Purpose: Provides standard wording for an individual to request a copy of the personal data an organisation holds about them, citing Article 28 of the DPJL 2018.
• Content prompts: Includes placeholders for the requester's details, a description of the data sought, willingness to provide proof of identity, preferred response format, and a request for confirmation of receipt.
• Legal reminder included: The template notes that under the DPJL 2018 an organisation must respond to a subject access request without undue delay and, in any event, within four weeks of receipt, or explain any delay.

The letter also points recipients to JOIC guidance and contact details if the organisation needs help handling the request.

Key obligations

• An organisation that receives a subject access request must respond without undue delay and, in any event, within four weeks of receipt.
• If unable to comply within four weeks, the organisation should inform the requester of the anticipated timescale and reasons for the delay.

Applies to

data controllers/organisations receiving subject access requests, individuals (data subjects)

Deadlines

• within four (4) weeks of receipt: Statutory timeframe under the Data Protection (Jersey) Law 2018 for an organisation to respond to a subject access request.