The Data Protection Act 1998 (‘DPA') came into force in March 2000. It regulates the use of information about living individuals and gives certain rights to individuals in respect of personal data held about them by others.
Individuals have the right to access personal information held about them, subject to exemptions under the DPA. A subject access request should be made in writing. On receipt of all necessary information required, data controllers should comply with the request within 40 days.
If you want to look more closely at the DPA, you can view it online.
The Information Commissioner is responsible for overseeing the DPA. More information can be found on the ICO website.