Find the record. Define the request. Close the loop.

Make a rights request

Use the Third Chair contact form and state the right or concern, the email address or interaction likely to locate the record, an approximate date and the outcome sought. Beginning with “data rights” helps routing, but a request does not need to cite legislation or use a particular form of words.

Do not send identity documents unless they are requested through a secure route. Only evidence reasonably needed to confirm identity and protect another person’s information will be requested.

Make a data-protection complaint

Use the same electronic contact route and explain what processing or response concerns you, when it occurred and what outcome would resolve it. Beginning with “data protection complaint” helps routing, but no magic wording is required.

The complaint will be acknowledged within 30 days. Without undue delay, appropriate steps and enquiries will be taken, the person will be kept informed, and the outcome and ICO route will be communicated. The 30-day acknowledgement period is not a promise that every investigation will conclude within 30 days.

What happens to an access request

A valid subject-access request is generally answered without undue delay and within one month. The period begins when the request and any proportionately required identity information or representative authority have been received. Most subject-access requests are free. A reasonable fee is available only in limited circumstances, such as a manifestly unfounded or excessive request or further copies. It can be extended by up to a further two months where necessary because the request is complex or numerous; the person must be told within the first month.

If clarification is reasonably required, the one-month access clock may pause when clarification is requested and resume after it is received. Clarification cannot be used to force a person to narrow a request. The search must be reasonable and proportionate.

Other data rights

Access, correction, erasure, restriction, objection and portability do not apply identically to every record or lawful basis. Each request is assessed against the actual processing, third-party rights, applicable exemptions and security needs. A refusal or restriction will explain the reason where law permits, the complaint route and the ability to approach the ICO.

Corrections to public editions

For a factual or source concern, include the permanent edition URL, disputed field and authoritative supporting record. Accepted material corrections should retain a transparent revision note rather than silently rewriting history. A public-edition correction is not automatically a personal-data request.

Accessibility and representation

A reasonable adjustment can be requested so a person can exercise a right. A properly authorised representative may act for another person, but authority and identity must be checked before personal information is disclosed. Responses are supplied through a clear, accessible and reasonably secure route.

Escalation

If a privacy concern is not resolved, a person may complain to the Information Commissioner’s Office and may have other legal routes. Copyright, accessibility, source and professional concerns follow their most relevant site room so the correct evidence and remedy can be considered.