RTT DATA RIGHTS FOR INDIVIDUALS

Last updated: 19 September 2025

Right to be informed

An individual has the right to be informed about the processing of their personal data. Therefore, an individual must be provided with sufficient information regarding the collection and use of their personal data from the outset. This is known as 'privacy information' and is generally provided in the form of a 'privacy notice'. Privacy information must be concise, in plain and simple language, and easily accessible to the individual.

Right to access

An individual has the right to access their personal data, and receive a copy of such data upon request. This is known as a 'subject access request' (SAR), which allows an individual to check whether the processing of their personal data is being carried out in a lawful manner.    

 A SAR may be made by, or on behalf of, an individual, either verbally or in writing, provided that the request relates to the processing of their own personal data. An organization that receives a SAR must comply without undue delay and within one month after receiving the request. This period may be extended by a maximum of two months if the SAR is complex or a part of numerous requests, provided that the individual is informed of the extension and the reason why.  

 A SAR entitles an individual to receive a copy of their personal data, as well as other supplementary information (normally set out in a privacy notice) relating to the processing of such data. An organization must respond to the SAR by providing the information in an appropriate format, consistent with the request. For example, if a SAR is made electronically, the information should be provided in a commonly used electronic format, such as a PDF document. 

A SAR may be refused in certain circumstances, where the request is manifestly unfounded or excessive.