UK GDPR: The UK General Data Protection Regulation - primary legislation governing data protection rights and obligations in the UK post-Brexit, including the fundamental right of data subject access under Article 15
DPA 2018: Data Protection Act 2018 - the UK's implementation of data protection laws, including specific exemptions under Schedule 2 that may affect data subject access requests
ICO Guidance: Regulatory guidance from the Information Commissioner's Office specifically addressing how organizations should handle Data Subject Access Requests
EDPB Guidelines: European Data Protection Board guidelines which, while not binding post-Brexit, remain influential in UK data protection practices
Time Limit Requirements: Statutory requirement to respond to DSARs within one month, with possible extensions for complex requests
Identification Requirements: Legal obligation to verify the identity of the person making the DSAR before disclosing personal data
Fee Regulations: Rules regarding DSAR fees - typically free of charge, but reasonable fees may be charged for excessive or repetitive requests
Format Requirements: Obligations regarding the format in which personal data should be provided to the data subject
Human Rights Act 1998: Legislation protecting fundamental rights including the right to privacy, which intersects with data protection rights
Freedom of Information Act 2000: Legislation relevant when the organization receiving the DSAR is a public body, potentially affecting how requests are handled
PECR: Privacy and Electronic Communications Regulations - additional rules that may be relevant when handling electronic personal data
