You may be trying to access this site from a secured browser on the server. Please enable scripts and reload this page.
Turn on more accessible mode
Turn off more accessible mode
Skip Ribbon Commands
Skip to main content
Turn off Animations
Turn on Animations
back to GOV portal
About the Office
Mission and Vision
The Data Protection Commissioner
The Powers of the Commissioner
The Functions of the Commissioner
Data Protection Act 2017
Data Protection Regulations
Controllers and Processors
Principles relating to processing of personal data
Your Legal Obligations
Roles & Responsibilities of Data Protection Officer
Exceptions and restrictions
Right of Access
Automated individual decision making
Rectification, erasure or restriction of processing
Right to object
Exercise of rights
Guidelines Data Protection Act 2017
Privacy Compliance Assessment
Useful References and Links
Data Protection Office
Rights of Access
Right of Access
At a glance:
* Individuals have the right to access their personal data and supplementary information
* The right of access allows individuals to be aware of and verify the lawfulness of the processing
What information is a data subject (individual) entitled to under the Act?
Data subject has the right to obtain the following:
* confirmation of whether, and where, the controller is processing their personal data;
* information about the purposes of the processing;
* information about the categories of data being processed;
* information about the categories of recipients with whom the data may be shared;
* information about the period for which the data will be stored (or the criteria used to determine that period);
* information about the existence of the rights to erasure, to rectification, to restriction of processing and to object to processing;
* information about the existence of the right to complain to the Commissioner;
* where the data were not collected from the datasubject, information as to the source of the data; and
* information about the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on data subjects.
Access rights are intended to allow individuals to check the lawfulness of processing and the right to have a copy of their personal data and these rights should not adversely affect the rights of others.
How do I as an individual make an access request?
* write to the controller or
* fill in the Rights of Data Subject Form available in the Data Protection Regulations 2017 and send it to the controller.
In case the request is manifestly excessive, the controller may charge a fee for providing the information or taking the action requested, or else the requested action will not be taken.