Subject access requests

The UK General Data Protection Regulation (UK GDPR) provides you with the right of access to personal data we hold about you.

Do it online

Apply to access data about yourself

If you need to, you can also download and complete a form and return by post or email.

What you need to know

The UK GDPR and the Data Protection Act make us responsible for handling your information securely and efficiently, and for ensuring we do not disclose it to other people or organisations without meeting legal conditions that protect your privacy (for example, we may have to ask your permission).

If you want to see the information we hold on you, please complete and return the subject access request form on this page and send it to the address given on the form.

You need to include copies of the following with the form:

  • proof of identity such as a driving license, passport, or government identification card
  • proof of residency such as a driving license, current benefits or pensions statement, current rent statement or tenancy agreement, or a recent (within the last three months) utility bill with your name on it

Please send copies of your proof of identity and residency. Do not send original documents.

Can I make a subject access request verbally?

You can make a subject access request verbally, but we recommend you put it in writing if possible because this gives you a record of your request.

If you are making a verbal request, try to:

  • use straightforward, polite language;
  • focus the conversation on your subject access request;
  • discuss the reason for your request, if this is appropriate – work with them to identify the type of information you need and where it can be found;
  • ask them to make written notes – especially if you are asking for very specific information; and
  • check their understanding – ask them to briefly summarise your request and inform them if anything is incorrect or missing before finishing the conversation.

However, even if you make your request verbally, we recommend you follow it up in writing (eg by letter, email or using a standard form).

Requesting information on behalf of a third party

We will ask for proof of your authority to act for a third party if you are making a request on their behalf (for example proof of power of attorney, or proof of parental responsibility).

Children are generally considered competent to make a subject access request at age 12 or over.

We will require proof of parental responsibility before disclosing any information.

For more guidance on what your request should look like, please check the ICO website

CCTV footage and disclosures to other organisations

We generally only hold CCTV footage for a calendar month. If the subject access request is not made within this time frame, we may no longer have the footage.

If you are an organisation making a request under The Data Protection Law Enforcement Directive, make a disclosure request.

Information Commissioner Office

For further information, please visit https://ico.org.uk/your-data-matters/