A data subject is entitled to see personal information that is held about them. You must provide information requested by data subjects without delay and in any event within one month (although it can be extended to two months in certain conditions).
There is no requirement for the request for a subject access request to be made in writing.
You must be satisfied of the requester’s identity before fulfilling the request.
Subject to a few conditions, these must be provided free of charge. Subsequent copies of subject access requests may be charged for, but the charge must be reasonable and based on administrative costs.
Providing Certificates of registration
Under data protection legislation no charge can be made for fulfilling a subject access request unless the request can be deemed excessive or repetitive. In the majority of instances, providing confirmation of a data subject’s entry on the register via a certificate of registration will not meet this test and therefore no charge should be made.