The ICO explains that the right of access in Part 3 of the Data Protection Act 2018 is a fundamental right that applies to processing by competent authorities. It is more commonly known as the right to make a subject access request.

The right allows individuals to find out what personal data is held about them for law enforcement purposes and to obtain a copy of that data. Following on from its initial guidance on this right, the ICO has now drafted detailed guidance which explains in greater detail the rights that individuals have to access their personal data and the obligations on competent authorities. The draft guidance also explores situations involving joint controllers, how to deal with requests involving the personal data of others, and the restrictions that are most likely to apply in practice when handling a request.

At the same time, the ICO has also drafted updated guidance on the provisions in Part 3 on how authorities should deal with manifestly unfounded or excessive requests.

The ICO is consulting on both pieces of draft guidance to gather the views of stakeholders and the public. These views will inform the published version of the guidance by helping the ICO to understand the areas where organisations need clarity, in particular considering their experiences in dealing with subject access requests since May 2018.

The deadline for responses is 5 pm on 11 March 2022. To access the consultation, click here.