How to make a subject access request
You have a right to ask us whether we are using or storing your personal data. This is called the right of access. It is commonly known as making a subject access request or SAR.
You can make a subject access request to find out:
- what personal information we hold about you (and request a copy)
- how we are using it
- who we are sharing it with
- where we got your data from
You can make a subject access request verbally or in writing.
What we ask for
You’ll need to provide the following when making a SAR:
- your name (including any other names you may have been known by)
- your address
- details of what you are asking for
- how you would like to receive this information from us, for example by email or in writing.
Documents you must provide
Do not send original documents. Photocopies are accepted.
You’ll need to provide:
- photo identification (driving licence or passport)
- proof of address (utility bill issued within the last three months).
Why we ask for this
We ask for this information so we can:
- respond to you
- contact you if we need more information about your request
- update you on the progress of your request
We will also use these details in any subsequent complaints into the handling or outcome of a request.
If you do not provide the information we need, we will not be able to process your request. This is so we can comply with our obligations under the General Data Protection Regulations (2016) (GDPR) (opens in new tab) and Data Protection Act (2018) (opens in new tab).
The legal basis for asking for this information is outlined in article 6(1)(C) (opens in new tab) of the GDPR.
When you’ll get a response
You’ll normally get a response from us within one month. If the request is complex, it might take up to three months.
Will I receive all the information I request?
Your right of access only allows you to receive your own personal data, subject to certain exemptions.
The Data Protection Act doesn’t provide rights to access information about our organisation’s:
- investigations
- complaints
- regulatory functions.
It also doesn't allow you a right of access to documents, but we may provide you with a redacted copy if possible.
What if I am unhappy with the reply?
The Information Commissioner’s Office (ICO) is responsible for making sure that organisations behave in accordance with the Data Protection Act.
If you’re not happy with our reply, you should request an internal review from us at the Gambling Commission. Someone who was not involved in the original response will look at your case then give you a decision. The ICO website has guidance on contacting an organisation if you’re not happy with a reply (opens in a new tab).
After this step, if you’re still not happy you can complain directly to the ICO (opens in a new tab). The ICO will investigate your complaint further.
Next pageHow we handle subject access requests
Last updated: 1 November 2022
Show updates to this content
Following an audit the breadcrumb has been amended.