Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, how long on average it takes his Department to respond to a subject access request; and what proportion of such requests are answered after 20 days.

The Cabinet Office endeavours to respond to all Subject Access Requests (SARs) received within the Statutory timescales listed within the DPA2018 and UK GDPR legislation which is within one month. This commitment is reflected in our performance data for SARs responses: in the last fiscal year (2022-2023) we received 686 requests, of which 678 requests (over 98%) were responded to within the legal deadline of one calendar month. We extended the deadline for the remaining 8 requests due to their complexity and responded to these requests within the 3 month extension period.

The Cabinet Office Data Protection Officer (DPO) is responsible for investigating any SAR complaints. The DPO’s investigation provides independent oversight to resolve complaints. In all of our responses to subject requestors, we proactively emphasise that there is a complaints process, and advise anyone who has concerns about how their personal data has been handled to contact the department's DPO directly. We also inform the subject requester of their legal right to make a complaint to the Information Commissioner’s Office (ICO), the independent regulatory body, should further resolution be required. We, in the Cabinet Office, fully cooperate with any subsequent investigations by the ICO.