Quickly exit this site by pressing the Escape key Leave this site
This site is a beta, which means it's a work in progress and we'll be adding more to it over the next few weeks. Your feedback helps us make things better, so please let us know what you think.
You have the right to ask us if we're processing your personal data and, if so, to access your personal data. This is known as your right of access. Making a request is known as a right of access request or subject access request.
UK GDPR Article 15 DPA 2018 (Section 43) gives you this right.
But we may restrict access, in full or in part, in some circumstances. For example:
If we do restrict access to your personal data, in full or in part, we'll tell you why.
You have the right to appeal to the Information Commissioner's office (ICO). You can also lodge a complaint. If you think we've broken data protection laws, you can take us to court.
Further information on your information rights is available here:
Right of rectification (change or update)
Right of erasure (deletion)
Right to restriction of processing
Right to object
Children can apply for access to their personal data. They must be able to understand their rights and make the request freely. We'll respond directly to the child. Where it's in the best interests of the child, we'll accept and respond to a parent or guardian.
To make an application on someone else's behalf, you need to ask them to fill in and sign the third-party permissions form (PDF, 91KB) to give their permission. You need to either upload a photo or scan of the completed form or share it with us when you make your application.
The signature on the form must match the one on their identity document (ID).
Employers can't ask employees or contractors to submit a request for personal data as a condition of their employment or contract. It's also an offence for anyone to ask you to do so if you provide goods, facilities or services.
You don't have to complete the application below. But if you do, it gives us all the information we need to help us respond to your request quicker. In any case, you need to give us enough information to help us locate your personal data.
This is particularly important if or when we hold a lot of data. If you don't give us enough information, this may delay our response to your request.
We'll confirm that we've received your request. We usually respond within 30 days. But it can take up to two months extra. For example:
This is in line with GDPR rules.