Subject Access Request

The Data Protection Act governs the information that we hold about you, how we use it and how you can access it.

What is Data Protection?

We have a duty to look after the information we hold about individuals. This means that we must:

• Only use your information for lawful purposes;
• Tell you what we are going to do with your information;
• Not use it for other reasons;
• Ensure that it is accurate and kept up to date;
• Not ask for more information than we need to do our job;
• Keep the information secure;
• Not keep it longer than necessary;
• Not send it to countries with less rigorous Data Protection laws than ourselves without your permission.

You can see all of our privacy notices for each service here. 

What is the right of access?

You have the right to ask an organisation whether they are using or storing your personal information. You can also ask them for copies of your personal information, verbally or in writing.

This is called the right of access and is commonly known as making a subject access request or SAR.

The Subject Access Request Form will give you an idea of how to write or phrase your request.

You can make a subject access request to find out:

• What personal information an organisation holds about you;
• How they are using it;
• Who they are sharing it with; and
• Where they got your data from.

This information can also help you exercise your other information rights effectively.

When will we respond?

We usually respond to your request within one month.

If you have made a number of requests or your request is complex, we may need extra time to consider your request. We can take up to an extra two months to respond.

If we need to do this, we will let you know within one month that we need more time and why.

Fees

In most circumstances, we can give you a copy of your personal information free of charge. However, in certain circumstances we can charge a reasonable fee to cover their administrative costs.

We can also charge a fee if you ask for further copies of your information following a request.

What will I receive?

When we respond to your request, we will tell you whether we process your personal information and, if we do, give you copies of it. We will also usually include:

• What we are using your information for;
• Who we are sharing your information with;
• How long we will store your information,
• Details on your rights to challenge the accuracy of your information, to have it deleted, or to object to its use;
• Your right to complain to the ICO;
• Details about where we got your information from.

If you specifically wish to receive this additional information, we recommend you state this in your request.