How to exercise your rights

What you need to do

• Send your request to the organisation in writing (this includes email), or verbally
• Be clear about what you want or which right(s) you wish to exercise
• Keep records of your correspondence
• Specify if you want a response in hard copy if you exercise your right by electronic means
• If you want the information provided to you orally, you must specify this and provide evidence of your identity

We recommend that verbal requests are followed up in writing as this gives you the opportunity to explain your concern, provide any evidence and state your desired solution. It will also provide a record of your actions, if needed.

• Exercising rights against a government department? See here for contact details of the relevant data protection officer

What will organisations do?

Organisations

• may ask you to provide evidence to confirm your identity if they have reasonable doubts about who you are - this is to ensure that any actions they take are on behalf of the right person
  • for example, if you have requested access to your personal data, they will need to be sure that they are sending your personal data to you and not to any other person
• cannot charge a fee unless your request is manifestly unfounded or excessive, particularly if the request is repeated
• must respond to you without undue delay but within one month
  • compliance with a request to exercise a right can be delayed by a maximum of TWO months, if necessary, where the requests are particularly complex 
  • if there is a delay, the reason for the delay must be explained to you within ONE month of receipt of the request
• must communicate to you about the exercise of your right in writing in a concise, transparent, intelligible and easily accessible form, using clear and plain language
• may refuse to act if your request is manifestly unfounded or excessive, particularly if the request is repeated
• must tell you if they are not taking any action, and why, within one month
• must tell you about your right to make a complaint to the Commissioner and to seek compensation though the courts

Rights may be restricted in certain instances, but controllers should explain this to you if restrictions are applied.