Subject Access Requests
The question
To ask the Secretary of State for Science, Innovation and Technology, what steps his Department is taking to help improve enforcement where employers (a) delay and (b) withhold data in response to subject access requests.
Answered by Ian Murray
The ICO can and does take action against organisations, as a result of people’s complaints about their right of access to personal data. Information about the ICO’s enforcement action is available at: https://ico.org.uk/action-weve-taken/.
A requester may also apply for a court order requiring an organisation to comply with a subject access request or to seek compensation. It is a matter for the court to decide, in each particular case, what action to take.
The ICO is currently consulting on changes to how it handles complaints, with a view to improving data protection compliance. The consultation closes on 31 October: https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2025/08/ico-consultation-on-draft-changes-to-how-we-handle-data-protection-complaints/.
Verbatim has judged this answer against the question that was actually asked — answered, partly answered, or evaded. Sign in to see the verdict →