This box is not visible in the printed version.
Information published under the Freedom of Information act on how to make a Subject Access Request (SAR).
Published: 23 September 2020
Last updated: 26 February 2025
This version was printed or saved on: 1 May 2025
Online version: https://www.gamblingcommission.gov.uk/contact-us/guide/how-to-make-a-subject-access-request
Overview: You have a right to ask us whether we are using or storing your personal data. This is called the right of access. It is commonly known as making a subject access request or SAR.
You can make a subject access request to find out:
You can make a subject access request verbally or in writing.
You’ll need to provide the following when making a SAR:
We have received a request from you for copies of the personal information that we have stored about you.
Time Period
We aim to provide your information within one month, in line with the terms of the General Data Protection Regulation and Data Protection Act 2018.
We aim to keep you informed about our progress. We will usually email you to confirm that we have received your request and ask for proof of your identification (ID) if we need to verify your identity. If we do this, the one-month time limit will not begin until we have received your ID. We will also confirm our understanding of the data you are requesting and the timetable by which we aim to provide it.
We may email you and ask for further information to help us find the personal information you are requesting.
We may also email to tell you that we will need extra time to process your request which could take up to three months. If this is the case, we will contact you within one month and explain why.
We will provide you with the information we have found and explain if we have withheld any information and why by email.
We will try to provide you with the information, but it may not always be possible because:
Where information has been filed under your name it is easier for us to find, for example information in our contact management system or staff records.
In general systems such as email and file storage, it is harder to find your information. We will perform automated searches of these systems; however, this has limitations. For example, we will search for your first name and surname and check the information to make sure it is right. We will not search our systems just for references to your first name as this would return a disproportionate amount of information. If you think we hold something specific, please tell us so we can focus our search.
We do not provide you with correspondence you have sent to us or correspondence we have sent to you. We assume that you already have this unless you request a specific item.
When we have found your information, we provide it to you in a usable and accessible format. We will also ensure that we are not providing you with personal information about third parties. In order to do this, we will lay out information into a format that could be read if printed.
Where your information is stored with information about other people and/or topics, we either extract (cut and paste) your information into a new file, or we redact (black-out) the information or opinions of other people or topics.
Sometimes your name may appear in a file, but that file contains no other information about you. In this case, we will only provide you with the name of a document where your name appears but contains no other information about you.
Ordinarily we provide your information in a PDF format, however, please let us know if you have accessibility issues and need different formats.
When we have provided you with your information, please check it. If you think something is missing, and can give us more information, we will search our systems again.
Our team fulfilling these requests are specialists. They are not involved in our primary regulatory work and make no judgement about why you want your information or other business you may have with us. They will use their judgement to protect the privacy of other people and to ensure that the information is not exempt from disclosure.
Further information about how we use personal information is detailed within our privacy statement available on our website.
Do not send original documents. Photocopies are accepted.
You’ll need to provide:
We ask for this information so we can:
We will also use these details in any subsequent complaints into the handling or outcome of a request.
If you do not provide the information we need, we will not be able to process your request. This is so we can comply with our obligations under the General Data Protection Regulations (2016) (GDPR) (opens in new tab) and Data Protection Act (2018) (opens in new tab).
The legal basis for asking for this information is outlined in article 6(1)(C) (opens in new tab) of the GDPR.
You’ll normally get a response from us within one month. If the request is complex, it might take up to three months.
Your right of access only allows you to receive your own personal data, subject to certain exemptions.
The Data Protection Act doesn’t provide rights to access information about our organisation’s:
It also doesn't allow you a right of access to documents, but we may provide you with a redacted copy if possible.
The Information Commissioner’s Office (ICO) is responsible for making sure that organisations behave in accordance with the Data Protection Act.
If you’re not happy with our reply, you should request an internal review from us at the Gambling Commission. Someone who was not involved in the original response will look at your case then give you a decision. The ICO website has guidance on contacting an organisation if you’re not happy with a reply (opens in new tab).
After this step, if you’re still not happy you can complain directly to the ICO (opens in new tab). The ICO will investigate your complaint further.
Your request for information will be logged and stored in our electronic filing system. Each case file includes the original request, information you've provided to us and any other information relevant to the request.
We may share the details of your request between our internal departments, depending on the subject matter.
If you are making a request for your personal data (or acting on behalf of someone making a request), you’ll need to provide proof of identity. If it's relevant, we'll also ask for information to show you have authority to act on someone else's behalf.
If your request is about information we’ve received from another organisation, we’ll ask the relevant organisation for their view on whether we can disclose the material.
The retention period is set at 3 years from the date of the last action. All information is held in line with the our retention schedule.
We keep details of requests to compile statistical reports on performance. We also use them for staff training and development.
We may share your personal data with the Information Commissioner's Office (ICO) as the supervisory authority when required.
If you want to know more about your rights, please refer to the Your Rights section in our privacy statement.
When you send your request, include:
We’d recommend reading the ICO’s guidance on preparing and submitting your request (opens in new tab).
Once we’ve reviewed your request, we’ll ask you to provide ID for the person the request is about. If the request is on behalf of someone else, you’ll also need the appropriate consent.
Your request won’t be processed until we receive this information.
You can make a subject access request in one of the following ways:
Use our online form to make a request online.
If you’d prefer to make your request verbally, you can contact us by phone.
Telephone: 0121 230 6666.
We publish data on the number of requests we receive and the outcomes of responses.
You can find subject access request data in the publication scheme section of the website.