Data subject access requests are becoming a common tool in disputes between individuals and companies. This article considers the nature of companies' obligations to provide information under the data protection legislation.