Part 3: Law enforcement processing Chapter 3: Rights of the data subject Section 45: Right of access by the data subject
This section sets out the right of access accorded to data subjects and the information that should be disclosed on request so that the data subject is aware of, and can verify the lawfulness of the processing. Securing such access would then enable a data subject, if necessary, to exercise the other rights provided for in this Chapter, namely the rights to rectification, erasure or restriction on processing. Controllers must respond to subject access requests without undue delay and, in any event, within one month (compared with 40 days under the 1998 Act).
	As with the previous section, the subject access rights conferred by this section are not absolute and subsection (4) provides for the same grounds on which a subject access request may be refused, whether wholly or in part. Operationally, law enforcement bodies may receive a subject access request from an individual who, unknown to them, is under investigation. If this investigation forms all the information held about the data subject, then informing them that their rights have been restricted for the purpose of "avoiding prejudice to the investigation, detection, investigation or prosecution of criminal offences or the execution of criminal penalties" could potentially alert the data subject to the existence of the investigation and could lead to the investigation being compromised. Instead, the data subject would receive a "Neither Confirm nor Deny" response. As a safeguard, the controller must record why they have restricted the access rights of a data subject and make the record available to the Commissioner (if requested).