Any living individual whose personal data is being processed by an organisation can make a Subject Access Request (SAR). This includes employees, customers, patients, service users, and members of the public.
Requests can also be made by:
-
Legal representatives acting on behalf of an individual.
-
Parents or guardians requesting access to a child’s data (subject to capacity and best interests).
-
Third parties with written authorisation.
A SAR does not need to mention “Subject Access Request” explicitly — any written or verbal request to access personal information qualifies. The organisation must respond lawfully, ensuring confidentiality and data integrity throughout the process.
