Dealing with Subject Access Requests
Section 5 of the Act provides individuals with a right of access to their personal data. This is a fundamental right and is one of the cornerstones of the legislation.
This right allows individuals to make a written request to any organisation ("data controller") the individual considers may be processing their personal data and is frequently exercised to enable the individual to find out what personal data is actually being processed.
If a subject access request is not dealt with as required, then the individual may make a request for assessment to the Data Protection Supervisor. Information regarding how the Supervisor deals with requests for assessment and what actions can be taken against the data controller can be found in our guidance note.
In addition, the individual may seek compensation from the organisation for damage, distress and damage, or distress alone, due to the failure of the organisation to comply with the subject access request. The organisation may also be subject to a fine of up to £5000, if a Court is satisfied that the failure was unjustified and that the organisation knew, or ought to have known, that the failure was unjustified.
A suite of guidance for organisation that have received a subject access request to enable them to comply with the request in compliance with the requirements of the Act is available below .
To download these documents you will need the Adobe Acrobat Reader. This is available free of charge from Adobe by using the following link:
| Title | File Size | Format | Document Title |
|---|---|---|---|
| Complying with a Subject Access Request | (207 kb) | Acrobat PDF File | Advice on dealing with s Subject Access Request |
| Complying with a subject access request - Flowchart | (68 kb) | Acrobat PDF File | Flowchart to assist in dealing with a subject access request |
| Is it 'personal data'? | (68 kb) | Acrobat PDF File | How to decide whether information is 'personal data' |
| Is it "personal data"? - flowchart | (36 kb) | Acrobat PDF File | Flowchart to assist in determining what is "personal data" |
| Subject Access Requests and Job References | (45 kb) | Acrobat PDF File | Guide to disclosure of employment references |
| Subject Access Requests - Personal data in complaint files | (94 kb) | Acrobat PDF File | Subject Access Requests - Personal data in complaint files |
| Subject Access Requests - Dealing with opinions | (51 kb) | Acrobat PDF File | Subject Access Requests - Dealing with opinions |
| Subject Access Requests & Third Party Information | (49 kb) | Acrobat PDF File | Subject Access Requests & Third Party Information |
| Subject access requests and legal proceedings | (34 kb) | Acrobat PDF File | Subject access requests and legal proceedings |
| Your right of access to Health Records and Reports | (56 kb) | Acrobat PDF File | Health Records and Reports - your right of access |
| Subject access requests - charging for health records | (50 kb) | Acrobat PDF File | How much can be charged and when for requests for health records |
| Dealing with a section 38 assessment | (44 kb) | Acrobat PDF File | How the Supervisor deals with an assessments |
Material on the Data Protection Supervisor's site is independent of that hosted by the Isle of Man Government and is protected by copyright. The copyright owner is the Isle of Man Data Protection Supervisor. You may not make alterations or additions to the material on this site, or sell it or misappropriate it. Material may be downloaded or copied for personal use. However, appropriate acknowledgement of the copyright owner is required if material is re-published in any format.
