Making a Data Request on Behalf of Someone Else

When you can act for someone else

UK GDPR rights — such as the right to see a copy of personal data or to ask for it to be corrected — belong to the person the data is about, known as the data subject. Most of the time, people exercise these rights themselves. But the law also recognises that someone may not be able to, or may simply prefer to have another person help. In those cases you can make a request on their behalf, provided you are genuinely entitled to act for them.

There are a few common situations. A parent or guardian may act for a young child who is too young to make a request themselves. A person holding lasting power of attorney, deputyship, or a similar legal authority may act for an adult who cannot manage their own affairs. And any competent adult can simply authorise a friend, relative, or adviser to make a request for them in writing — the data subject stays in charge and is just delegating the task.

The key point is consent and authority. You are not asserting your own rights; you are exercising someone else's, with their permission or under a recognised legal authority. The organisation that holds the data has to be satisfied that you are entitled to act before it hands over personal information — which protects the data subject from someone requesting their data without permission. This is general information, not legal advice.

• A parent or guardian acting for a child who cannot yet act for themselves.
• An attorney or court-appointed deputy acting under a recognised legal authority.
• A friend, relative, or professional adviser acting with the person's written permission.
• In every case, the rights remain the data subject's — you are acting for them, not instead of them.

How to make the request, step by step

Making a request for someone else follows the same shape as making one for yourself, with one extra ingredient: proof that you are allowed to act. Taking it in order keeps things calm and avoids back-and-forth with the organisation.

Work through the steps below. The aim is to give the organisation everything it reasonably needs in one clear message, so it can respond without having to come back for missing details.

• Confirm your authority. Make sure you have the person's written permission, or the legal authority (such as a power of attorney) that lets you act for them.
• Identify the right organisation. Work out which organisation — the data controller — holds the data and find its privacy or data-protection contact.
• Write the request clearly. State that you are making the request on behalf of the named person, say which right you are exercising (for example, access or rectification), and give enough detail to identify their records.
• Include proof. Attach the signed authority or a copy of the legal document, and be ready to confirm both your identity and the data subject's.
• Send it and keep a dated copy. Email or post the request to the organisation's privacy contact, and keep a record of what you sent and when.

What the organisation will ask for, and what to expect

Before releasing someone's personal data to a third party, an organisation must be reasonably sure of two things: that you are who you say you are, and that you are entitled to act for the data subject. So expect to be asked for evidence of the authority — a signed letter of authority, or a copy of a power of attorney — and for proof of identity for yourself and, often, for the person you are acting for. This is a safeguard for the data subject, not an obstacle put in your way.

Once the organisation is satisfied, it handles the request as it would any other: for an access request, it usually has one calendar month to respond, free of charge in most cases. The response goes to you as the authorised representative, although an organisation may sometimes choose to provide the information directly to the data subject if it has concerns about their interests — for example, where a child is involved.

A few uses are worth keeping in mind. Acting for someone is not the same as overriding their wishes — if the person can make their own decisions, the request should reflect what they want. And no representative, including OSINTA, can force an organisation to act beyond what the law requires; OSINTA can help a person understand their own footprint and frame and route their own request, but the decisions stay with them. If an organisation will not co-operate, you have the right to complain to the Information Commissioner's Office (ICO). This is general information, not legal advice.

Frequently asked questions

Related terms

• Data Subject Access Request (DSAR)
• GDPR (General Data Protection Regulation)
• Data controller
• Personal data