Section 94: Right of access, Data Protection Act 2018

An individual is entitled to obtain from a controller—

confirmation as to whether or not personal data concerning the individual is being processed, and

where that is the case—

communication, in intelligible form, of the personal data of which that individual is the data subject, and

the information set out in subsection (2).

That information is—

the purposes of and legal basis for the processing;

the categories of personal data concerned;

the recipients or categories of recipients to whom the personal data has been disclosed;

the period for which the personal data is to be preserved;

the existence of a data subject's rights to rectification and erasure of personal data (see section 100);

the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;

any information about the origin of the personal data concerned.

Under subsection (1), the data subject is only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search for the personal data and other information described in that subsection.

A controller is not obliged to provide information under this section unless the controller has received such reasonable fee as the controller may require, subject to subsection (4).

The Secretary of State may by regulations—

specify cases in which a controller may not charge a fee;

specify the maximum amount of a fee.

Where a controller—

reasonably requires further information—

in order that the controller be satisfied as to the identity of the individual making a request under subsection (1), or

to locate the information which that individual seeks, and

has informed that individual of that requirement,

the controller is not obliged to comply with the request unless the controller is supplied with that further information.

Where a controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless—

the other individual has consented to the disclosure of the information to the individual making the request, or

it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

In subsection (6), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request.

Subsection (6) is not to be construed as excusing a controller from communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

In determining for the purposes of subsection (6)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the other individual concerned, regard must be had, in particular, to—

any duty of confidentiality owed to the other individual,

any steps taken by the controller with a view to seeking the consent of the other individual,

whether the other individual is capable of giving consent, and

any express refusal of consent by the other individual.

Subject to subsections (3), (5) and (6), a controller must comply with a request under subsection (1)—

promptly, and

in any event before the end of the applicable time period.

If a court is satisfied on the application of an individual who has made a request under subsection (1) that the controller in question has failed to comply with the request in contravention of this section, the court may order the controller to comply with the request.

A court may make an order under subsection (11) in relation to a joint controller whose responsibilities are determined in an arrangement under section 104 only if the controller is responsible for compliance with the obligation to which the order relates.

The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session.

In this section—

"the applicable time period" means the period of one month beginning with the relevant time, subject to subsection (14A);
"the relevant time", in relation to a request under subsection (1), means the latest of the following—
(a)when the controller receives the request,
(b)when the fee (if any) is paid, and
(c)when the controller receives the information (if any) required under subsection (5) in connection with the request.

The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

the complexity of requests made by the data subject, or

the number of such requests.

A notice under subsection (14A) must—

be given before the end of the period of one month beginning with the relevant time, and

state the reasons for the delay.

Regulations under this section are subject to the negative resolution procedure.

Section 94: Right of access

Discussed in

About this text