Letter — response to data subject access request
Dated: [insert date]
To: [insert employee’s name and address]
Dear [insert name of employee]
Thank you for your letter requesting access to personal data of which you are the data subject, which we received on [insert date].
[We also acknowledge receipt of your [cheque for £10] in payment of the fee for complying with your request, and for the copy documents you provided to confirm your identity/Your request cannot be dealt with until we receive [[a cheque for £10 payable to [insert employer’s name]] in payment of our fee for complying with your request/a certified copy of your [passport/driving/specify other document] to enable us to confirm your identity].
[Unfortunately, we cannot respond fully to your request until you give us further details about the information you are seeking. Section 7(3) of the Act states that a data controller must be provided with sufficient information to locate the information which you would like to see. Therefore, to help us respond properly to your request and give you access to the information in which you are most interested, could I ask you to be more specific in your request as follows:
(a) You have requested access to all emails, including back up tapes, which the Company holds about you. To search the Company’s entire email system, including back up tapes, and provide you with copies would involve a disproportionate effort for the Company and we are not therefore willing to provide these copies. Please inform us which period of time you would like us to search against and provide us with the names of the people whose email accounts you would like us to search
(b) Our policy on email is only to provide copies of emails which are about you as a person and have you as their focus, not every email merely addressed or copied to you or sent by you, which may relate to business activities, rather than you as an individual. Ordinarily, we will only search up to [12] different people’s email accounts spanning a [24 month] period of your choice. However, if you feel that a wider search would be justified on the basis that it will be necessary to check the accuracy of your data, then please explain your grounds for believing this and we will consider them.
(c) Your request for all other documents that mention you is too wide. Such an open ended request does not meet the requirements of section 7(3) of the Act. Please let me know specifically which documents or type of documents you require, and where it is not obvious, indicate where these documents might be found.
(d) Please inform us whether you want a copy of information which you have already been given (such as your offer letter, contract of employment and payslips).]
[Please note that the 40-day statutory time limit for complying with your request will not begin to run until we received payment of the fee and confirmation of your identity as required above. The time limit may also be extended if we cannot comply with the request without disclosing data relating to someone else who can be identified from it and we need to obtain their consent before making the disclosure to you.]
The data is provided in electronic format [in accordance with your request/because it [is not possible/would involve disproportionate effort] to provide the information on permanent form].
We searched [specify departments or other locations] for data within the scope of your request using the following methodology [specify methodology].
We found the following personal data within the scope of your request, copies of which we enclose save where it has been deleted or omitted as indicated below:
Information comprising personal data within the scope of your request
Data source
Purpose for which it is processed
[Classes of] Recipients to whom it is or may be disclosed
Information deleted or omitted
Reason for omission or deletion
Yours sincerely
[signature]
[insert name]
For and on behalf of [insert name of employer]