Can I ask for more information before responding to a subject access request?
The Act allows you to confirm two things before you are obliged to respond to a request.
First, you can ask for enough information to judge whether the person making the request is the individual to whom the personal data relates. This is to avoid personal data about one individual being sent to another, accidentally or as a result of deception.
The key point is that you must be reasonable about what you ask for. You should not request lots more information if the identity of the person making the request is obvious to you. This is particularly the case, for example, when you have an ongoing relationship with the individual.
However, you should not assume that, on every occasion, the person making a request is who they say they are. In some cases, it is reasonable to ask the person making the request to verify their identity before sending them information.
The level of checks you should make may well depend on the possible harm and distress which inappropriate disclosure of the information could cause to the individual concerned.
The second thing you are entitled to do before responding to a subject access request is to ask for information that you reasonably need to find the personal data covered by the request. Again, you need not comply with the subject access request until you have received this information. In some cases, personal data may be difficult to retrieve and collate. However, it is not acceptable for you to delay responding to a subject access request unless you reasonably require more information to help you find the data in question.
As with a request that is sent without the required fee, you should not ignore a request simply because you need more information from the person who made it. You should not delay in asking for this, but should ensure the individual knows you need more information and should tell them what details you need. Provided you have done so, the 40-day period for responding to the request does not begin to run until you have received the appropriate fee and any additional information that is necessary.