Individuals have the right to ask companies to disclose any information they hold about them - known as a 'subject access request'.
Under data protection rules, you must provide any data you hold within 40 days of the request. This covers all data, whether it is held electronically, in paper form or in any other form.
The guide 'How to disclose information safely: Removing personal data from information requests and datasets' from the Information Commissioner's Office (ICO) explains:
- how to avoid releasing information about other third parties
- how to deal with data held in spreadsheets and other documents that may be hidden
Download the ICO guide from the ICO website.