Data Protection Act 1984

21 Right of access to personal data

(1) Subject to the provisions of this section, an individual shall be entitled—

(a) to be informed by any data user whether the data held by him include personal data of which that individual is the data subject; and

(b) to be supplied by any data user with a copy of the information constituting any such personal data held by him;

and where any of the information referred to in paragraph (b) above is expressed in terms which are not intelligible without explanation the information shall be accompanied by an explanation of those terms.

(2) A data user shall not be obliged to supply any information under subsection (1) above except in response to a request in writing and on payment of such fee (not exceeding the prescribed maximum) as he may require ; but a request for information under both paragraphs of that subsection shall be treated as a single request and a request for information under paragraph (a) shall, in the absence of any indication to the contrary, be treated as extending also to information under paragraph (b).

(3) In the case of a data user having separate entries in the register in respect of data held for different purposes a separate request must be made and a separate fee paid under this section in respect of the data to which each entry relates.

(4) A data user shall not be obliged to comply with a request under this section—

(a) unless he is supplied with such information as he may reasonably require in order to satisfy himself as to the identity of the person making the request and to locate the information which he seeks ; and

(b) if he cannot comply with the request without disclosing information relating to another individual who can be identified from that information, unless he is satisfied that the other individual has consented to the disclosure of the information to the person making the request.

(5) In paragraph (b) of subsection (4) above the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request; and that paragraph shall not be construed as excusing a data user from supplying so much of the information sought by the request as can be supplied without disclosing the identity of the other individual concerned, whether by the omission of names or other identifying particulars or otherwise.

(6) A data user shall comply with a request under this section within forty days of receiving the request or, if later, receiving the information referred to in paragraph (a) of subsection (4) above and, in a case where it is required, the consent referred to in paragraph (b) of that subsection.

(7) The information to be supplied pursuant to a request under this section shall be supplied by reference to the data in question at the time when the request is received except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.

(8) If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data user in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request; but a court shall not make an order under this subsection if it considers that it would in all the circumstances be unreasonable to do so, whether because of the frequency with which the applicant has made requests to the data user under those provisions or for any other reason.

(9) The Secretary of State may by order provide for enabling a request under this section to be made on behalf of any individual who is incapable by reason of mental disorder of managing his own affairs.