The ICO exists to empower you through information.

Purpose and lawful basis for processing

You can use our subject access request service to ask for your personal information from an organisation.

We provide this service to help you exercise your right of access and support the organisation receiving your request.

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a regulator.

If the information you provide us as part of your request contains special category data, such as health or religious information or criminal offence data the additional lawful basis we rely on to process it are article 9(2)(g) of the UK GDPR, which also relates to our public task and Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.

What we need

As a minimum you will need to provide your name and email address. We also encourage you to provide other useful information, such as your date of birth, telephone number and any relevant customer reference numbers. This is to help the receiving organisation find any relevant information and respond to your request.

What we do with it

The service will create an email to the organisation you specify, with your request for your personal information and everything they need to respond. You'll also get a copy for your records. We won't see the reply you receive, the organisation should reply to you directly.

How long we keep it

We typically retain a copy of your access request for 14 days from the date you submit it.

As we use Twilio Sendgrid to support our email infrastructure and the operation of this service, random content samples may be retained by Twilio for no more than 61 days.

What are your rights?

For more information on your rights, please see 'Your data protection rights'.

Do we use any data processors?

We use Twilio Sendgrid to support our email infrastructure and the operation of these services. We use a third-party web application firewall from Cloudflare to help maintain the security and performance of our website. We host our website in Microsoft Azure in the UK. Please see Visitors to our website and How you can contact us for further information.