Subject Access Request to the Labour Party

Labour publishes one form for every data right, and the same form handles access, correction, erasure, restriction and complaints. Choose "Data Subject Access Request (DSAR)" from the Rights Request Type(s) list. The form is hosted on airtable.com rather than on a Labour domain, and it asks for no identification: Labour requests that by email after it receives the request. You can also email dataprotection@labour.org.uk or post a letter, and the party asks for the same details either way. This route reaches records held by the national party — membership records, complaints and disciplinary files, selection and candidacy applications, and canvassing records taken on the doorstep. It does not reach records held only by your Constituency Labour Party, your local Labour candidate, or an MP's or councillor's office. Labour's members privacy notice says those are "separate data controllers", and hundreds of constituency parties hold their own ICO registration. Scottish Labour and Welsh Labour both point their own privacy pages at the national party's data protection pages, so this is the route they publish. Labour publishes two different postal addresses. The one above is the one its data protection pages give for requests; its general address, and the one on its ICO register entry, is Labour Central, Kings Manor, Newcastle upon Tyne NE1 6PA. Send a request to the London address. If someone else sends the request for you, expect an email. Labour says that where a third-party data rights provider is used it will email you to confirm you asked for it, and will not continue if you do not reply. A request sent by a friend, relative or adviser needs a letter from them signed by you giving permission. Labour says it will extend the 30 days by up to two further months for a complex request, and it treats a request made during a selection appeal, a disciplinary investigation or litigation with the party as complex. The Information Commissioner's Office reprimanded the Labour Party in August 2024 for failing to respond to subject access and erasure requests, after requests went to a privacy inbox the party had stopped monitoring in November 2021. Use the published form or the dataprotection address, keep a record of the date you sent it, and complain to the ICO if nothing comes back.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.