Data protection - Subject Access Request
You are entitled (as a Data Subject) to be told if we hold any information about you and if so, to be provided with a copy of that information. This is called a Subject Access Request (SAR) and this gives you the right to Access, granted under the Data Protection Act.
Please note, information is subject to our Data Retention Policy and can only be provided if we still hold any relating to you and exemptions do not apply.
For more information on the right of subject access, please go to the Information Commissioner's Office (ICO) website.
When you make an application, we will:
- tell you whether we hold any of the requested data on you
- give you a copy of any requested data, subject to exceptions.
The current data protection legislation confirms we are not required to provide with information:
- from References we give for the purposes of an individual's education, training or employment or the provision of a service by us
- that we are required to publish and is publically available
- that would obstruct an official or legal inquiry, investigation or procedure
- that would enable prejudices of the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
- that would impact public or national safety
- that would infringe on the rights and freedoms of others.
If my data falls under an exception, does this mean I won't get the full document?
You will receive the data you have requested, providing that it does not fall under one of the exceptions. If it falls under any of the exceptions mentioned, then we could either:
- not disclose the data/documents
- remove information from documents by 'redacting data' to take away any information that belongs to another living person.
We will fulfil your request within one calendar month of the day after you submit your request. Therefore if your request was made on 29 March, we would complete it by 30 April.
Please note: there is a discretionary extension of up to three months for requests that are manifestly unfounded or excessive.
SARs are free unless your request is manifestly unfounded, excessive or you require duplicate copies. In this situation, we reserve the right to charge a reasonable fee of £25 per complete copy for the administrative costs of complying with such requests.
Before we are able to process any requests, we must be sure of your identity.
We will make every effort to achieve this using the information we hold on you, but there will be some occasions where we may need additional information to confirm your identity. Where this situation arises you will be notified by the subject access team that additional checks need to be completed and this may require submission of identity documents.
Under the Data Protection Act (2018) and the General Data Protection Regulations (GDPR), it is an offence for a person to require you to apply for information from us for the purposes of:
- your continued employment (this includes works carried out under a contract of services or office holder, apprenticeships, volunteering and work placements)
- for any contract for the provision of services.
If you have been required to complete this form for any of the above reasons, the person asking you to do so may have committed an offence. If this is the case, please contact us.
We will only accept requests for another person's personal data if they give consent to do so or you have legal represented powers i.e. power of attorney. You will be asked to provide evidence of this.
Can I make a claim for a deceased relative or friend's data?
The Data Protection Act only applies to the living and therefore this is not a subject access request.
We would provide you with that information if you can provide your legal right for us to do so.
There is no formal requirement of how a request should be made. To help us process your request more effectively, you can complete our optional form below, which will send it through to our Subject Access team. This form is to provide the data subject with information they are entitled to under the Data Protection Act. It applies to any information that can directly or indirectly identify a living person.
When making a request, either verbally or in writing, please provide as much information as possible including timeframes, types of data and nature of the data to enable us to give you what you are seeking.
If you have any queries please email firstname.lastname@example.org.
Data subject - this is the person on whom the information is being requested is related to.
Representative - this is someone requesting the data on behalf of the data subject. We will only be able to provide data to a representative who has authority through formal written consent, which must be attached below, or though legal routes such as power of attorney covering the information requested.