What are Data Protection Requests / Subject Access Requests?

I’m re-drafting the latest ebook which is about complaining to HMRC in a tax investigation (what they don’t tell you / what you should know / how to get a good result – it’s that kind of thing). I’m working on the first chapter at the moment and – really – the advice here is: don’t complain until you have made a Data Protection Request (now called a Subject Access Request).

Subject Access Requests are a lottery – you might pull back some really useful information or it could be a single page with your address on! But the thinking from the people inside HMRC is that you are more likely to get a good result if you put in a request in before you complain. And you can see the logic behind that!

Anyway, here’s the draft first chapter – I’m always interested in feedback BTW! Oh and the other books are here.

Before you complain you should use the Data Protection Act to make a Subject Access Request

Why should I do this?

The Data Protection act allows you to make ask to see the files HMRC hold about you. This could be anything from documentation showing simple appointment dates to detailed meeting notes and it may also contain notes about what HMRC feels are the strengths and weaknesses of your case. This request is called a Subject Access Request or SAR.

Sounds interesting how do I make this ‘SAR’?

To make a ‘Subject Access Request’ you can apply online here: https://online.hmrc.gov.uk/shortforms/form/DPU_SAR or you can apply in writing. Here’s the strategy for applying in writing. Call the HMRC office you’ve been dealing with and ask to speak to the ‘Data Protection Officer’ – when you get through you need to get the name of the person you are talking to or the person in charge of ‘Subject Access Requests’. It’s important to get a name.

Then write your request stating that you want to see all your files and post it off the same office – or even better – hand deliver it and get a stamped receipt.

HMRC’s information about requesting up a Subject Access Request are on their website https://www.gov.uk/government/publications/data-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you/data-protection-act-dpa-information-hm-revenue-and-customs-hold-about-you.

Will I see everything?

How transparent HMRC is about the case file is largely down to luck. They don’t have to release comprehensive information, but sometimes – if the file is big and they don’t have much time to edit it or the task has been given to somebody junior – you may just get a copy of the whole thing – other times you may get a drastically cut back version – perhaps only a page! It is – frankly – a lottery.

How many requests can I make?

You can make as many SARs as you like and it costs nothing, so it’s worth going for.

Any tips?

Try to get the name of the person who is in charge of Data Protection requests and talk with them directly, get a direct telephone number and email address if you can. HMRC have 40 days to comply with the request, make a note in your diary and call if they fail to meet the deadline.

Can I complain if I get nothing back?

Yes, you can complain to the Information Commissioner, call 0303 123 1113 (local rate) or 01625 545 745 (national rate). Alternatively email casework@ico.gsi.gov.uk