Work is underway to update the guidance to take account of the provisions of the Data (Use and Access) Act 2025. The sections of the Act that have relevance are section 76 and 78. It is expected that a revised version of the guidance will be complete later this year.

Subject Access Requests (SARs) made under UK data protection legislation are handled by a number of specialist teams across the Home Office, depending on the nature of the request.

SARs relating to borders, immigration and citizenship matters are handled by the Subject Access Request Unit (SARU) within UK Visas and Immigration. Passport-related SARs are handled by HM Passport Office (HMPO), and SARs relating to modern slavery are handled by the Single Competent Authority (SCA). The Knowledge and Information Management Unit (KIMU) handles SARs from current and former members of staff, and SARs from members of the public that do not relate to these specialist areas.

The reference numbers used for SAR responses vary between teams:

SARU: "SARU-" followed by seven numerical digits.

HMPO: "Disc/Info" followed by the requestor's surname and the date the request was received.

SCA: A National Referral Mechanism (NRM) case reference, which may take different formats depending on when the case was referred. For cases referred post 28 April 2019 the reference will be six to nine numerical digits

KIMU: "SA" followed by four numerical digits.

As a result, SAR responses issued by the Home Office do not all follow the format of "SARU" followed by a series of numbers; the format used depends on the team handling the request.

The internal Subject Access Request manual was drafted in 2018. This has not been updated given the legislation underpinning the guidance remains the same.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP completed 16,032 subject access requests within the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP received 44,482 subject access requests.

This figure includes requests that were not progressed because DWP was unable to verify the identity of the requestor & was therefore unable to validate the request.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), the average completion time for completed subject access requests was 43.3 days.

During the 2-year period June 2024 to May 2026 inclusive (i.e. the 24-month period prior to the question), DWP completed 23,712 subject access requests that exceeded the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP completed 16,032 subject access requests within the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP received 44,482 subject access requests.

This figure includes requests that were not progressed because DWP was unable to verify the identity of the requestor & was therefore unable to validate the request.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), the average completion time for completed subject access requests was 43.3 days.

During the 2-year period June 2024 to May 2026 inclusive (i.e. the 24-month period prior to the question), DWP completed 23,712 subject access requests that exceeded the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP completed 16,032 subject access requests within the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP received 44,482 subject access requests.

This figure includes requests that were not progressed because DWP was unable to verify the identity of the requestor & was therefore unable to validate the request.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), the average completion time for completed subject access requests was 43.3 days.

During the 2-year period June 2024 to May 2026 inclusive (i.e. the 24-month period prior to the question), DWP completed 23,712 subject access requests that exceeded the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP completed 16,032 subject access requests within the statutory deadline.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), DWP received 44,482 subject access requests.

This figure includes requests that were not progressed because DWP was unable to verify the identity of the requestor & was therefore unable to validate the request.

During the 12-month period June 2025 to May 2026 inclusive (i.e. the 12-month period prior to the question), the average completion time for completed subject access requests was 43.3 days.

During the 2-year period June 2024 to May 2026 inclusive (i.e. the 24-month period prior to the question), DWP completed 23,712 subject access requests that exceeded the statutory deadline.

The Cabinet Office follows guidance issued by the Information Commissioner’s Office, and information on how the department handles Subject Access Requests is available on Gov.uk - https://www.gov.uk/government/organisations/cabinet-office/about/personal-information-charter.

It has not proved possible to respond to the Hon Member in the time available before Prorogation.

It has not proved possible to respond to the Hon Member in the time available before Prorogation.

I refer you to the Government's response to the Urgent Question tabled on 12th February, the Written Ministerial Statement in the name of the Chief Secretary to the Prime Minister that same day, and the Oral Statement on the 23rd February, in the name of the Chief Secretary to the Prime Minister, which set out an update on the Government's process and that Departments have been instructed to retain material that may be relevant to the motion.

All organisations in the UK that act as data controllers are required to comply with the UK GDPR and the Data Protection Act 2018, including data subject rights such as the right of access.

When a firm enters administration, it continues to trade and remains in existence, although it is financially distressed and technically insolvent. Where it continues to act as a data controller, it remains subject to subject access requests in accordance with data protection law.

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) provide individuals with the right to access their personal data, subject to relevant exemptions. A subject access request must be responded to within one month of receiving the request. The response time may be extended by a further two months if the request is complex, or if the individual has submitted a number of requests, provided the organisation informs the requestor within the one-month period and provides reasons for the delay.

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the data protection legislation independently of government, and is accountable to Parliament.

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) provide individuals with the right to access their personal data, subject to relevant exemptions. A subject access request must be responded to within one month of receiving the request. The response time may be extended by a further two months if the request is complex, or if the individual has submitted a number of requests, provided the organisation informs the requestor within the one-month period and provides reasons for the delay.

NHS England has produced guidance for patients and service users on making a Subject Access Request (SAR), and for professionals to ensure they can respond to requests in a timely manner. It can be found here: https://transform.england.nhs.uk/information-governance/guidance/subject-access-requests/

The Information Commissioner’s Office (ICO) is responsible for monitoring and enforcing the data protection legislation independently of government, and is accountable to Parliament.

Information on the number of data subject access requests received by National Health Service organisations, and the time taken to respond, is not collected centrally.

Compliance with data protection obligations, including the handling of Subject Access Requests (SARs), is the responsibility of individual police forces. The Information Commissioner’s Office (ICO) produces guidance for organisations on how to comply with data protection law.

The Data (Use and Access) Act received Royal Assent in June 2025 and includes some changes to data protection obligations while maintaining high standards of protection for personal data.

The ICO can and does take action against organisations, as a result of people’s complaints about their right of access to personal data. Information about the ICO’s enforcement action is available at: https://ico.org.uk/action-weve-taken/.

A requester may also apply for a court order requiring an organisation to comply with a subject access request or to seek compensation. It is a matter for the court to decide, in each particular case, what action to take.

The ICO is currently consulting on changes to how it handles complaints, with a view to improving data protection compliance. The consultation closes on 31 October: https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2025/08/ico-consultation-on-draft-changes-to-how-we-handle-data-protection-complaints/.

Compliance with data protection obligations, including the handling of Subject Access Requests (SARs), is the responsibility of individual police forces. The Information Commissioner’s Office (ICO) produces guidance for organisations on how to comply with data protection law.

The Data (Use and Access) Act received Royal Assent in June 2025 and includes some changes to data protection obligations while maintaining high standards of protection for personal data. As part of the development of that legislation, Home Office officials engaged with policing stakeholders in the usual way.

As under previous administrations, guidance set out by the Information Commissioner’s Office is followed here:

https://ico.org.uk/for-organisations/foi/freedom-of-information-and-environmental-information-regulations/determining-whether-we-hold-information/