HMRC updates guidance on accessing personal tax data under DPA

Due to the large volumes of data HMRC handles, it has updated its guidance relating to compliance with the Data Protection Act 1998 (DPA) to ensure it meets the eight data protection principles, stressing that requests must be supported with strict identity verification documents

In terms of basic service level agreement, HMRC has confirmed that it must respond and provide information within 40 days of the initial request.

In the guidance, HMRC has also clarified how taxpayers can access information from the tax authority and the manual process. However, some information is available via the online service, including pay and national insurance, and more general enquiries covering income tax, tax credits, child benefit and VAT.

Accessing personal data

To access their own personal data, including records and other related information that HMRC holds, taxpayers need to submit a subject access request (SAR) to HMRC.

All requests must be submitted in writing to the local HMRC office which the taxpayer has been dealing with and must be addressed to the ‘data protection officer’.

To ensure that the correct information is provided by HMRC, it is important to include enough details to enable HMRC to verify your identity and locate the relevant information.

The supporting information should include the following:

  • date of birth;
  • previous or other name(s) used;
  • previous addresses in the last five years;
  • personal reference number(s) that HMRC has provided, for example, national insurance number, tax reference number or VAT registration number; and
  • the type of information required.

Anyone without a NI must send a copy of:

  • back page of passport or copy of driving licence; and
  • recent utility bill.

There are no charges for dealing with a DPA request.

The online facility is only available for personal requests for information.

If you are acting on behalf of another individual, you must submit your request by post or fax. You must include a mandate, which has been signed by the person to whom the information relates within six months of the submission date of your request.

HMRC has the right to refuse your request for information in certain circumstances. For example, if you have previously made a similar request and there has been little or no change to the data since the original request was compiled.

The HMRC guidance on Data Protection Act (DPA) - information HM Revenue & Customs hold about you is available here

Be the first to vote

Rate this article

Related Articles