Generally, yes, if they ask for it, so be careful about the information you hold on individuals. The 'subject access request' must be in writing, and you must be certain that the person asking for the information is the person who is entitled to see it. You can require them to pay a fee of up to £10 and you must provide them with the information they have requested within 40 days of satisfying yourself as to their identity and receiving the fee. There are exemptions which you can use to withhold certain types of information, and you are specifically required to protect the rights of third parties, if they can be identified from the information you are disclosing. The Information Commissioner's Office (ICO) publications on their website (www.ico.gov.uk) include a 'good practice' note for small and medium-sized businesses on how to handle 'subject access requests'. See also questions six and seven for futher information on what types of record are covered by the Data Protection Act 1998.
