Data protection legislation provides that a person may make a subject access request to see personal information that is held about them. No charge can be made for fulfilling a subject access request unless the request can be deemed excessive or repetitive. Subsequent copies may be charged for, but the charge must be reasonable and based on administrative costs.
There is no requirement for the request to be made in writing. You must, however, be satisfied of the requester's identity before complying with the request. Information requested by data subjects must be provided without delay and in any event within one month (although it can be extended to two months in certain conditions).
Where an elector requests a letter confirming their residency, known as a certificate of registration, this should be treated as a subject access request. In the majority of instances, providing confirmation of a data subject’s entry on the register via a certificate of registration would not be considered excessive or repetitive, and therefore no charge should be made.