Undertaking issued for failure to comply with right of access

Published On:Tuesday, August 8, 2017


The Department of Economic Development has signed an Undertaking in respect of its future compliance with subject access requests.  The Undertaking is available by following this link.


Individuals have a statutory right of access to their personal data, the exercise of which is referred to as making a subject access request.  Individuals can make a subject access request for any of their personal data at any time, subject only to the limited restrictions set out in the Data Protection Act. The duty on data controllers is to comply with requests promptly and in any event within 40 calendar days.

The Information Commissioner therefore reminds all data controllers that they must comply with subject access requests in accordance with the Act.  Failure to comply with a subject access request may result in the individual making a complaint to the Commissioner and/or taking the matter to court.  Individuals are entitled to compensation if they have been caused damage or distress by reason of the data controller contravening any of the requirements of the Act, including the right of access.

A suite of guidance is available on the website in respect of compliance with subject access requests together with a selection of relevant UK case law