The right of access under Article 15 of the General Data Protection Regulation (GDPR) applies to a person's own personal data. Therefore, access requests tend to be made by the individual themselves in relation to their own personal data.  It would however be reasonable to comply with an access request submitted on a person's behalf by their own solicitor.

In relation to children, legal guardians can exercise their child’s data protection rights on their behalf subject to it being in the best interests of the child. It is important to note that the data remains that of the child and is not the legal guardian’s personal data and they do not have an automatic entitlement to the child’s personal data from the data controller. The age of the child is also a relevant factor for consideration as an older child may be in a position to exercise those rights on their own behalf.

For further information, you can read our guidance on Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Protection and Children, Parents, and Data Protection: Can I Make a Complaint on Behalf of my Child?

Finally, an individual can sign a letter of authority that authorises another person to act on their behalf if they wish. However, it is a matter for the data controller as to whether they are satisfied with that letter of authority as data controllers are responsible for the security of the personal data under their control.