A collection of resources to assist organisations acting as controllers in handling data subject requests under the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) and Data Protection Act 2018 (DPA 2018). This toolkit includes resources on data subjects' rights under the UK GDPR and controllers' related obligations. This toolkit also includes standard forms covering the different types of data subject requests and template controller response letters (which can be adapted for personal data covered by the DPA 2018 rather than the UK GDPR).

For an EU version, see Toolkit, Handling Data Subject Requests Under the GDPR.

For information on the right of access to pupil records, see Practice note, Pupil records and information (UK GDPR and DPA 2018).

For information on the right of access in employment, see Data subject access requests in employment: toolkit (UK GDPR).