How to exercise your rights under the Data Protection Act

Knowing you have a right under sections 42 to 49 is one thing. Sections 37 to 41 are where the Act sets out how that right actually turns into a response from a business, and what a business has to tell you even before you make a request.

The one-month deadline

Section 38 governs the response process for every right in sections 42 to 49:

The data controller shall, on request being made by the data subject, provide information on any action taken under section 42 to 49 to the data subject without undue delay, and in any event within one month of receipt of the request. (s.38(3))

That deadline can be extended, but not casually:

The period in subsection (3) may, taking into account the complexity and number of the requests and with the approval of the Commission, be extended by a period not exceeding two months. (s.38(4))

The extension is not automatic and not entirely the controller’s own call: it needs the Commission’s approval, and section 38(5) requires the data subject to be told about the extension, and the reasons for it, within that first month, not after the original deadline has already passed.

Underneath all of that sits a plain-language requirement from section 37 that applies to how any of this gets communicated:

The data controller shall take appropriate measures to provide information relating to processing in a concise, transparent, intelligible and easily accessible form using clear and plain language. (s.37(1))

A response that is technically complete but written in dense legal or technical language does not satisfy that standard.

What businesses must tell you before you even ask

Sections 39 to 41 flip the direction of the obligation. Rather than waiting for a data subject to ask, a controller has to proactively disclose certain information, generally at the point personal data is collected:

• The identity of the controller and its contact details.
• The purposes of the processing and the legal basis for it.
• The recipients, or categories of recipients, the data may be shared with.
• The retention period, or the criteria used to work it out.
• The existence of the rights covered elsewhere in this guide: access, correction, deletion, restriction, portability and objection.
• The right to complain to the Commission.

Where the data is obtained directly from the data subject, section 39 governs this disclosure. Where the data comes from somewhere else instead, such as a third-party list or a public source, section 41 applies, and it adds a further requirement on top of the section 39 and 40 disclosures: the controller has to say where the data came from, and, if applicable, whether it came from a publicly accessible source.

What a well-written information notice looks like

In practice, this obligation is usually met by a short notice given at the point of collection, something like: “We are [business name], contactable at [contact details]. We collect this information to process your order and for our own marketing analysis, based on your consent for the marketing use. We may share it with our delivery partner. We keep it for two years after your last order. You can access, correct, delete or ask us to restrict or transfer this data at any time, and you can complain to the Information and Data Protection Commission if you are not satisfied with how we have handled it.” That single notice, given up front, does most of the work sections 39 and 40 require, before any specific right ever needs to be exercised.

For the mechanics of a specific request, such as what has to be handed over and how, right of access is a good place to see this process applied to a single right in detail.