What should we do if we refuse a Subject Access Request?

You must inform the individual without undue delay and within one month of receipt of the request.

You should inform the individual about:

  • the reasons you are not taking action;
  • their right to make a complaint to the ICO or another supervisory authority; and
  • their ability to seek to enforce this right through a judicial remedy.

You should also provide this information if you request a reasonable fee or need additional information to identify the individual.