Explain
Subject access request (getting personal records)
Everyone has the right to ask an organisation, such as a council or school, for a copy of the personal information it holds about them. A parent can usually ask for a child who agrees or cannot ask themselves. The organisation must normally reply within one month of getting the request, or any proof of identity or fee it asks for. This can be extended by two more months if the request is complex or there are many requests. It is usually free. The records can help when preparing for a review, a complaint or an appeal.
Time spent waiting for information the organisation reasonably needs to identify what the request is about does not count. To take the two extra months, it must say so, with its reasons, within the first month.
- Type of rule
- Law (Act or Regulations)
- Rule id
subject_access_request- Rules version
- england-2026.10
- Law as at
- 30 September 2026
Sources
- UK GDPR, art 15Law (Act or Regulations)
- UK GDPR, arts 12(3) and 12ALaw (Act or Regulations)
- Data (Use and Access) Act 2025, s 76Law (Act or Regulations)
- UK GDPR, art 12(5)Law (Act or Regulations)
- Information Commissioner's Office: the right of accessOfficial guidance
Related
In an assistant, the ehcp_calculate_deadlines tool helps with this: EHCP deadlines.
If you think this rule is wrong or out of date, please tell us. A person reads every report.