Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 95 is up to date with all changes known to be in force on or before 04 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 4Intelligence services processing
CHAPTER 3Rights of the data subject
Rights
95Right of access: supplementary
(1)
The controller must comply with the obligation imposed by section 94(1)(b)(i) by supplying the data subject with a copy of the information in writing unless—
(a)
the supply of such a copy is not possible or would involve disproportionate effort, or
(b)
the data subject agrees otherwise;
and where any of the information referred to in section 94(1)(b)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms.
(2)
Where a controller has previously complied with a request made under section 94 by an individual, the controller is not obliged to comply with a subsequent identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request.
(3)
In determining for the purposes of subsection (2) whether requests under section 94 are made at reasonable intervals, regard must be had to—
(a)
the nature of the data,
(b)
the purpose for which the data is processed, and
(c)
the frequency with which the data is altered.
(4)
The information to be supplied pursuant to a request under section 94 must be supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request.
(5)
For the purposes of section 94(6) to (8), an individual can be identified from information to be disclosed to a data subject by a controller if the individual can be identified from—
(a)
that information, or
(b)
that and any other information that the controller reasonably believes the data subject making the request is likely to possess or obtain.