Do I have a right to access my personal information?
Yes, you have a legal right to access personal information held about you by an organisation.
This right is protected by the Data Protection Act 2018 and General Data Protection Regulation (GDPR). These deal with your rights regarding information held about you by various organisations and agencies, including:
- social services
- the police
- your employer
- the Department for Work and Pensions.
However, there are some situations where an organisation is allowed to withhold personal information from you (not share it).
What records do I have a right to see?
You have the right to ask an organisation:
- what, if any, personal information it holds about you
- why it holds that information
- who it may be sharing your information with
- where the information came from
- for an explanation of any technical or complicated terms relating to the information.
You also have the right to see the information held about you and/or to be given copies of it. This includes both computerised and paper records.
What format should the records be in?
The organisation must provide copies of your records in a permanent form (for example photocopies, or digital copies on a USB memory stick or on a disk) – unless you have agreed to the information being provided in some other way (for example, viewing it at the organisation’s offices).
If you want the information in a particular format (such as on an encrypted USB memory stick), it's worth saying so when first making your request.
When is an organisation allowed to withhold information from me?
There are some specific situations where organisation is allowed to withhold personal information from you (not share it). These include:
If an organisation is refusing to share information with you for one of these reasons, they should write to you and explain why.
Manifestly unfounded or excessive requests
Organisations must usually make proper efforts to find all the information you have requested. They can't refuse your request purely because it will be inconvenient for them or require some work.
However, they don't have to comply with any requests that are ‘manifestly unfounded or excessive’. This could apply if:
- you request more information than you actually need
- you make repeated requests for the same information.
If an organisation thinks your request is excessive it should ask you to be more specific rather than refuse you outright.