Beta This part of GOV.UK is being rebuilt – find out what this means

HMRC internal manual

Collection of Student Loans Manual

HM Revenue & Customs
, see all updates

background: data protection act: applications by members of the public

The Data Protection Act (DPA) does not require an official form to be used for a formal application for subject access enquiries. It is unlikely that a letter will give sufficient information to be accepted as a formal application.

If you are asked for an official form, pass the name and address of the applicant to the Data Protection Unit (DPU) for a form to be issued.

There is no charge for applications under the DPA within HMRC.

On receipt of an application, either on a form or in a letter, always

  • Acknowledge receipt of the documents (even though your office may not be responsible for supplying the requested information)
  • Fax the application to the DPU immediately. The fax number is 03000 533130

The Department has to respond to each application within 40 days of its receipt. Immediate attention must be given to applications and enquiries at all stages.

All matters concerning detailed enquiries about the Act or any disputes about information supplied following an application should be referred to the DPU, who will decide what action should be taken.

The DPU examine all applications to confirm that sufficient information has been provided to the applicants. They are then sent to the appropriate Data Protection Officers for the searches to be made and for the relevant information to be supplied to enable formal replies to be made to the applicants.

The Data Protection Officer (DPO) will ask the office dealing with the computer systems on which data is held relating to the applicant to use certain functions to obtain screen prints.

On receipt of the note from the DPO

Use the functions specified by the DPO to obtain the screen prints

Send the screen prints to the DPO immediately

Include an explanation of any items which may not be self explanatory, for the benefit of the applicant

The DPO will then collate the data for all computer systems covered by the application and send it to the DPU for the official reply to be sent to the applicant.