Section 40(1) – personal information of the requester
This exemption confirms that you should treat any request made by an individual for their own personal data as a subject access request under the Data Protection Act 1998. You should apply this to any part of the request that is for the requester’s own personal data. They should not be required to make a second, separate subject access request for these parts of their request. See our
Guide to Data Protection – the rights of individuals (principle 6) for advice on how to handle subject access requests.
If the information contains some of the requester’s personal data plus other non-personal information, then you will need to consider releasing some of the information under the Data Protection Act and some under the Freedom of Information Act.
This exemption is absolute, so you do not need to apply the public interest test.
Requested information may involve the personal data of both the requester and others. For further information, read our guidance: