Section 56 of the Data Protection Act (DPA) is due to come into force on 1 December 2014.

The implementation of Section 56 means as of 1 December 2014 it will be a criminal offence to require a person to make a subject access request, as a condition of employment, to obtain protected personal data that they would normally have no access to (commonly referred to as “enforced subject access requests”.)

A breach of this section may incur fines ranging from £5,000 to an unlimited amount (depending on where the prosecution takes place in the UK). Senior staff involved may also face personal criminal liability. Therefore it is even more important that checks are only undertaken on those who the legislation allows.

Detailed information on Section 56 can be found at and on the Information Commisioner’s Office’s website.