- Q: An organisation has inaccurate information about me. What can I do?
- You should write to the organisation explaining what the problem is and where appropriate provide them with any evidence to show what the information should say. Keep copies of this correspondence. If, after a reasonable amount of time (we would recommend 28 days) the information has not been corrected, you can make a complaint under the Data Protection Act. Please ensure that you supply copies of your correspondence, evidence and, if applicable, any response you receive.
^ Back to top
- Q: Can an organisation charge me for giving me my personal information?
-
Requesting personal information from an organisation will usually cost a maximum of £10.00. However, in some cases it may cost more, for example, requesting a copy of your medical file:
- Information that is being processed by automated means (eg on computer): £10.00
- Information that is held manually or a combination of manual and automated records: up to £50.00
Requesting personal information including your education records:
- A sliding scale ranging from £1.00 - £50.00 depending on the number of pages to be provided.
^ Back to top
- Q: Can I use the Data Protection Act to access the records of my deceased relative?
- No. The Data Protection Act relates to living individuals. As a result, the Act does not oblige an organisation to supply you with this information. However, you may have a right to access a deceased person’s data through the Access to Health Records Act. You should visit the
Department of Health website for further information. It may be appropriate for you to request the information through the Freedom of Information Act.
^ Back to top
- Q: An organisation is holding information about me. How do I get it?
-
If you believe an organisation holds personal information about you, you can ask them to provide you with a copy.
In order to do this you will need to:
- make your request in writing (email is acceptable), clearly explaining or listing the information you want;
- keep a copy of this request for your records. If you need to make a complaint to us at a later date we will ask you for a copy of your original request;
- we would also recommend sending your letter by recorded delivery so you can be sure of its safe delivery.
^ Back to top
- Q: I keep receiving post addressed to someone else. What can I do?
- Organisations have an obligation to keep their information up to date. If you have tried to contact the organisation to make them aware of the problem but you continue to receive the inaccurately addressed mail, we can consider your complaint. You can make a complaint under the Data Protection Act.
^ Back to top
- Q: I want a copy of my employment references. How do I get them?
-
To request a copy of your references you need to make the request to the employer the references were sent to. You should make the request in writing as a Subject Access Request under the Data Protection Act. They will then consider if any exemptions apply and if they can release this information to you.
If you make the request to the employer responsible for providing the reference it is unlikely that you will get a copy, as they are not obliged to provide this under the Data Protection Act.
^ Back to top
- Q: There is inaccurate information on my credit file – what can I do to get it corrected?
- You will need to write to the lender and tell them of the inaccuracy, including proof where possible. If you do not get a reply or the information is still wrong, you may wish to contact the credit reference agency from where you obtained your file. If you are still not satisfied you can contact our office and ask us to consider whether an organisation has breached the Data Protection Act. You can do this by filling in a
complaint form. You will need to include a copy of your credit file (within the last 12 months), a copy of your letter to the lender, and any evidence that shows the information on your file is inaccurate, eg copies of bills showing your payments were up to date. If your complaint relates to a bankruptcy you will need to send your statement of affairs and certificate of discharge.
^ Back to top
- Q: Which Act allows me to get my personal information? And can they charge me?
-
The Data Protection Act 1998 gives you the right to apply for a copy of your personal information. You will need to put your request in writing, by letter or email, and send it to the person or organisation you believe holds this information. Make sure to put your name and address and keep a copy. It is a good idea to make clear you are asking for the information under the Data Protection Act 1998.
Yes, under the Data Protection Act they can ask for a fee of up to £10.00 for each request made.
For more information on your rights, read Subject Access - A guide for data subjects
^ Back to top
- Q: How do I need to ask for the information?
-
You can make a request of your personal information in writing, by post, letter or fax.
^ Back to top
- Q: I’ve made a request for my personal details. How long does it take?
- Once the organisation receives your request it has 40 calendar days (or 15 school days if the request is to a school) to get a copy of your information to you.
^ Back to top
- Q: My neighbour has installed a CCTV camera and it is pointing towards my house/garden. Is this a breach of the Data Protection Act?
- If your neighbour is a residential property not operating for commercial purposes, the answer is no. The Data Protection Act protects the personal information processed by organisations. When CCTV is installed for personal domestic use it is not regulated by the Data Protection Act. If you are concerned about the use of domestic CCTV it may be worth contacting your local police. If your neighbour is a business then they will need to comply with the Act. For more information,
contact our helpline or read our CCTV code of practice.
^ Back to top
- Q: I think a data controller has breached the Data Protection Act. What can I do?
-
Under Section 42 an individual has the right to make a complaint to the Information Commissioners Office.
Make a complaint - Data protection
^ Back to top
- Q: What protects my personal information when it is being passed to overseas companies and call centres?
-
The Data Protection Act prohibits the transfer of personal information from the UK to other countries unless those countries can ensure the same level of protection. Organisations can also set up contracts with overseas organisations receiving personal information. This ensures that a higher standard of protection is in place than there might have been in the receiving country.
Organisations in the UK which have personal information processed on their behalf overseas are responsible for the security of your information. The UK organisation is required to make sure the company overseas complies fully with the UK Data Protection Act.
^ Back to top
- Q: I was refused credit, is there anything I can do?
-
Under the Data Protection Act you can request a copy of your credit history file, which lists the loans, mortgages and credit cards you have and whether these have been paid on time. It will also show if the payment has gone into default or been satisfied. You can apply to one or all of the main credit reference agencies (Equifax, Experian or Call Credit). If any details on your file are incorrect you should go back to the person or organisation who has put this on your record and ask them to update their records.
^ Back to top
- Q: I think my personal information is wrong. Can I correct it?
-
Under the fourth principle of the Data Protection Act, information must be accurate and up to date. If you feel that your information is not factually accurate (this is information that can be proven to be inaccurate and not an opinion of the person or organisation) you must contact the person or organisation that is holding this information and tell them you believe your information needs updating to be factually accurate under the Data Protection Act. If they fail to do this and your information still remains factually inaccurate you can contact the ICO.
^ Back to top
- Q: I am receiving unsolicited marketing information through the post. What can I do about it?
-
There are generally two things you can do if you are a private individual receiving unsolicited marketing information through the post (junk mail):
- you can register your details with the Mail Preference Service. Although it is not a legal obligation for Data Controllers to check the MPS before sending junk mail most reputable organisations will do so; or
- you can exercise your right under the Act to ‘Prevent processing of your personal data for Direct marketing Purposes’ (section 11).
^ Back to top