That reads like it's for the big companies.

Something I've always wondered about this. Surely our obligation under MLR to keep up to date risk assessments of our clients overrides the amount and type of data we keep or allow our clients access to amend, under Data Protection? Or have I missed a vital point?

DPA covers personal information, so you don't have to give details on anything else such as risk assessment etc.

Personal DPA rights are:

• told whether any personal data is being processed;
• given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people;
• given a copy of the information comprising the data; and
• given details of the source of the data (where this is available).

Taken from http://www.ico.gov.uk/for_organisations/data_protection/the_guide/principle_6/access_to_personal_data.aspx

You can charge for this, and it can be presented, rather than a direct screen print, so for example, if you hold their address on Sage and in a customer database, you only need to list the address under details kept, and then list both systems under how it is kept and processed.