Right of Access (Section 37)
At a glance:
· Individuals have the right to access their personal data and supplementary information.
· The right of access allows individuals to be aware of and verify the lawfulness of the processing.
What information is a data subject (individual) entitled to under the Act?
Data subject has the right to obtain the following:
- confirmation of whether, and where, the controller is processing their personal data;
- information about the purposes of the processing;
- information about the categories of data being processed;
- information about the categories of recipients with whom the data may be shared;
- information about theperiod for which thedata will be stored (or the criteria used to determine that period);
- information about theexistence of the rights toerasure, to rectification,to restriction ofprocessing and to objectto processing;
- information about theexistence of the right tocomplain to the Commissioner;
- where the data were notcollected from the datasubject, information as to the source of the data; and
- information about the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on data subjects.
Access rights are intended to allow individuals to check the lawfulness of processing and the right to have a copy of their personal data and these rights should not adversely affect the rights of others.
How do I as an individual make an access request?
· write to the controller or
· fill in the Rights of Data Subject Form available in theData Protection Regulations 2017and send it to the controller.
In case the request is manifestly excessive, the controller may charge a fee for providing the information or taking the action requested, or else the requested action will not be taken.