If you are concerned that an organisation is holding personal information you have a legal right to ask for a copy of the information that they hold about you.

If it is a public organisation, write to their Data Protection Officer (DPO). Their details should be on the organisation’s privacy notice.

If the organisation has no DPO, or you do not know who to write to, address your letter to the company secretary.

How long it should take

The organisation must give you a copy of the data they hold about you as soon as possible, and within one month at most.

In certain circumstances, for example particularly complex or multiple requests, the organisation can take a further two months to provide data. In this case, they must tell you:

• within one month of your request; and
• why there’s a delay.

When information can be withheld

There are some situations when organisations are allowed to withhold information, for example if the information is about:

• the prevention, detection or investigation of a crime;
• national security or the armed forces;
• the assessment or collection of tax; or
• judicial or ministerial appointments.

An organisation does not have to say why they are withholding information.

How much it costs

Requests for information are usually free. However, organisations can charge an administrative cost in some circumstances, for example if:

• you are asking for a large amount of information; or
• your request will take a lot of time and effort to process.