If you want to know if a person or organisation holds information about you and, if so, what information they hold, you will need to write to that person or organisation and make a subject access request. You should ask for a copy of all the information they hold about you. If you are not sure who to write to in an organisation, address your letter to the company secretary. It is a good idea to include your full name and address in the heading, and any other information to help identify you and the information you need. For example, if you are making a request to a previous employer, they may need the dates when you worked for them to find the information about you. In other circumstances, a reference number such as your NHS number may be needed if you are requesting medical information, and so on. Be as specific as possible. It will help the organisation if you tell them exactly what information you want.

Some organisations make decisions using an automated process (for example, using a computer system to give you a credit rating). If you want them to also tell you about the logic involved in making these decisions, you should specifically say this in your letter.
 

Organisations may charge a fee of up to £10 (£2 if it is a request to a credit reference agency only for information about your financial standing). There are special rules that apply to fees for paper based health records (the maximum fee is currently £50) and education records (a sliding scale from £1 to £50 depending on the number of pages provided). You will have to pay a fee (if charged) for every request, so you need to specify all the information you need in your first letter, otherwise you may have to pay another fee to get information you have asked for on a different occasion.

Your full address
The Date
Dear Sir or Madam,

(Your full name and address and any other details to help identify you and the information you want.) Please supply the information about me I am entitled to under the Data Protection Act 1998 relating to (give details of the information you want). (Please would you also tell me the logic involved in any automated decisions you have made about me.) If you need any more information from me, or a fee, please let me know as soon as possible.

If you do not normally deal with these requests, please pass this letter to your Data Protection Officer or another appropriate officer.

Yours faithfully,
Signature
 

The organisation has to reply promptly, and at the most within 40 days, starting from the day they receive both the fee and the information they need to identify you and the information you need. A credit reference agency only has seven days to respond to a request for a credit file. If an organisation reasonably needs more information to help them find your information or identify you, as long as they tell you what they need, they do not have to deal with it until they have all the necessary information as well as the fee. The organisation should give you the information in writing but they need not do this if it is not possible or takes ‘disproportionate effort’ or you agree to some other form, such as seeing it on screen. The Act does not define what disproportionate effort means but we think the following should be taken into account:

•  The cost of giving you the information
•  The length of time it will take
•  How difficult it will be
•  The size of the organisation
•  The effect on you of not having the information in permanent form.
   

•  a copy of the information in permanent form;
•  an explanation of any technical or complicated terms;
•  any information the organisation has about where they got your information from;
•  a description of the information, the purposes for processing the information; and
•  who the organisation is sharing the information with; and
•  the logic involved in any automated decisions (if you have specifically asked for this).

Credit reference agencies give lenders a range of information about potential borrowers, which lenders use to make their decisions. The information may include your previous credit history. If you are asking a credit reference agency for information, they will only send you details that relate to your financial situation, unless you specifically say that you want other information, like in the sample letter. To get a copy of your credit file you should write to the three main credit reference agencies.

Call Credit plc
Consumer Services
One Park Lane
Leeds
LS3 1EP

Equifax plc
Team Credit File Centre
PO Box 1140
Bradford
BD1 5US

Experian Ltd
Consumer Help service
PO Box 8000
Nottingham
NG1 5GX
 

You should send:

•  a £2 fee;
•  your full name and address;
•  any other address you have lived at in the last six years; and
•  details of any other names you have used or been known by in that time.

Unless the agencies need any more information, they have seven working days from receiving your letter to provide you with a copy of your file.
 

Yes. There are some circumstances where the information you have asked for contains information that relates to another person. Unless the other person gives their permission, or it is reasonable in all the circumstances to provide the information without permission, the organisation is entitled to withhold this information. There are other circumstances where the organisation can withhold information under the Act. For example, if it would put at risk a criminal investigation or catching an offender. If you want more information on the circumstances when information may be withheld in this way, please see The OIC’s Website (www.OIC.gov.uk) under ‘Exempt information'. Also, the Act does not cover all personal information. However, it does cover personal information that:

•  is held, or going to be held on computer;
•  is in, or going to be in, a manual filing system that is highly structured so that information about you can be easily retrieved;
•  is in most health, educational, social service or housing records; or
•  is other information held by a public authority.

The Freedom of Information Act 2000, which applies to public authorities, amended the Act by creating another category of personal information. This category covers personal information held about you by a public authority that is:

•  partly organised, such as in a file with someone’s name on it which has been compiled in date order; or
•  is 'unstructured' material, and is not organised in a file or any other way.

You can request access to partly-organised information using a normal request as described on this Website. If you want access to unstructured information, you will need to describe the information you want so the authority can find it. Although the fee for access to public authority information is £10, the authority can estimate the cost of dealing with a request for unstructured information, and refuse the request if the cost is more than £450 (or £600 if it is central government). You cannot use this category to obtain access to unstructured personnel information held by a public authority. This is so employees of public authorities do not have more rights to access their personal information than employees in the private sector.
 

If you have sent all the necessary information (including any fee) and:

• the organisation does not respond to your request within 40 days; or
• you are not satisfied with their response;

you should send them a reminder letter by recorded delivery (and keep a copy of the letter). If you do not get a reply fairly quickly, or you think the information you receive is wrong or incomplete, you can:

• ask us to carry out an assessment to see whether it is likely or unlikely that the organisation has responded properly; or
• take legal action through the court. For information on how to do this, please see the OIC Website.

Our assessment will tell you if it is likely that the organisation has broken the Act and may help you decide whether to take legal action. However, you can take a case to court without asking us for an assessment.

If a court is satisfied that an organisation has not dealt with a subject access request in line with the Act, the court can order them to comply. The court also has the power to award compensation.

First, tell the organisation concerned and give it an opportunity to put things right. Many data protection problems can be solved quickly without us getting involved.

If you have contacted the organisation about the problem but have been unable to solve it, The OIC may be able to help. If necessary, they will look into your complaint. If they think the law has been broken, they can give the organisation advice and ask it to solve the problem. In the most serious cases they can order it to do so.

You should be aware that the OIC cannot award you compensation or punish an organisation for breaking the law. Their main aim is to get the organisation to change the way it works so that it handles personal information properly in the future.

If you have complained to an organisation about a data protection problem and it has corrected the mistake, the OIC is unlikely to take action. Their main concern is to help an organisation deal with personal information properly in the future. There is little point pursuing a problem when the organisation is already putting things right, particularly if the problem was an unusual or one-off event.

If your problem is serious, or is one of many similar cases the OIC has received, they may investigate. They can give the organisation advice on how to make sure the same thing doesn’t happen again.
 

If you are aware of a significant data protection problem that has not affected you personally, you can still tell the OIC about it. If they think the problem is serious, or is one of many similar cases, they may use your evidence to help them make sure the organisation handles personal information properly in the future.

To complain to the IC, you should fill in the ‘Data Protection Act 1998 complaint form’ available from the IC Website. This should help you give them all the information they need. You can also ask for a copy from their helpline on 08456 306060 or 01625 545745. If you are not sure whether you should send your complaint to them, call their helpline.

You should only send documents that are directly relevant to your complaint. If you send too many or irrelevant documents, the IC may return them and ask you to sort them out and return only the relevant ones.

If you do need to send the IC a lot of documents, make sure you clearly mark the relevant parts. If you do not, they may return them and ask you to do this. It is important that you give the IC all the relevant documents when you first contact them. They will not normally consider extra information added later, which you could
have given them when you made your original complaint.

The IC will examine your complaint to decide how they should handle it. When they first write back to you, they will give you a reference number that you should use whenever you contact them about the problem. If they need more information from you, they will write and let you know.

If they decide to look into your complaint, they will usually contact the organisation concerned. This may lead to an outcome they regard as satisfactory, and if so, they will let you know what has happened. The IC aims to deal with all complaints within a reasonable time, although sometimes it can be a long and complex process. They will let you know if there is going to be a long delay.

If they do not consider that they can take your complaint further, they will let you know. Details about their response times are available from their helpline on 08456 306060 or 01625 545745.

The IC will scan your documents and keep them electronically. In most cases, they will destroy the paper documents you send them after six months, so you should only send them copies. You should keep all your original documents. If they need these later on, they will let you know. If you cannot give them copies, you should make sure you ask them to return your original documents. You can do this in section 9 of the complaint form. You must make it clear each time you send them something if you would like them to return it to you.

If the IC thinks the organisation has breached the Act, they can ask them to put things right so that they comply with the data protection principles.

You should be aware that the IC cannot punish an organisation for breaking the law. Their priority is to get the organisation to change the way it handles personal information properly in the future. In most cases organisations will agree to comply with the data protection principles. If they do not, and the case is a serious one, the IC can order them to do so.

The IC has no power to award compensation. If you have suffered a loss because an organisation has broken the law, you may be entitled to compensation. You must claim this through the courts. The right to compensation applies even if you don’t report the problem to the IC. You can make a claim to the court whether or not the IC has agreed that the law has been broken. See the section on Compensation.

Most organisations agree to put problems right when the IC brings them to their attention. If they do not, the IC may consider taking formal legal action such as issuing an enforcement notice ordering them to do so. The IC will take a range of factors into account in deciding whether to issue a notice. These will include the seriousness of the problem, any damage or distress you or anyone else might have suffered and the cost to the organisation of putting problems right. An enforcement notice is a legally binding document that sets out what an organisation must do (or stop doing) to comply with the law.

If you are dissatisfied with the outcome of your complaint to the IC, you should let them know as soon as possible and certainly within six months of their final letter to you.