Subject Access Request
The General Data Protection Regulations (GDPR) 2018 provides you, the data subject, with a right to receive a copy of the data/information we hold about you or to authorise someone to act on your behalf.
The UK General Data Protection Regulation (‘UK GDPR’) provides you with several rights in relation to your personal data.
‘Personal data’ is any information that can be used to identify you, or which relates to you.
Your rights under the UK data protection legislation are the:Right to be informed – the right to know how and why we are processing your personal data (information that is typically detailed in our privacy notices)
- Right of access – the right to receive a copy of your personal data. You can do this by making a Subject Access Request (commonly known as a ‘SAR’ or a ‘DSAR’)
- Right to rectification – the right to have your inaccurate personal data updated
- Right to be forgotten – the right to have your personal data erased. There are limitations to this right, and we will need to retain and process certain information so we can deliver our services and bill you accordingly
- Right to restrict processing – the right to stop or restrict processing of certain personal data. As with the right to be forgotten, there are limitations to the type of data we can restrict
- Right to data portability – the right to transfer your personal data to another data controller
- Right to object – the right to object to the processing of your personal data, e.g., for marketing purposes
- Right not to be subject to automated decision-making including profiling
What information am I entitled to under a SAR?
This right of access entitles you to a copy of your personal data only. It does not entitle you to information about other people, e.g., your neighbours, friends, or family, and it does not entitle you to any company or commercial information. We are unable to disclose any information that does not directly relate to you.
Can I get a copy of my personal data by submitting a Freedom of Information Request?
No. The Freedom of Information Act 2000 is a different piece of legislation to the UK GDPR and Data Protection Act 2018. We are not subject to the Freedom of Information Act, or its requirements, and we are therefore not required to provide any information under this legislation.
If you are looking for information that we hold about you, then you are looking to exercise the right of access. You can do this by submitting a Subject Access Request - also known as a ‘SAR’ or ‘DSAR’.
How do I submit a SAR?
You may submit a SAR for yourself, or you may authorise someone to act on your behalf and make the request for you. However, where you authorise someone else to make the request for you, we will need to see proof of authority before we can provide them with your personal data.
Please click on this button below if you wish to exercise any of your data rights including submitting a SAR.
Please complete all question labelled with * as the form will not submit without answers to these questions.
Where the form asks for details of the request, please use this space to tell us what information you are looking for and when we might have collected that information. By providing us with more detail about which of your personal data you would like to see, it will help us to locate it more easily for you.
Proof of Identity
You will also need to provide proof of your identity. Your request will be processed upon receipt of a fully completed form and proof of identity. You can upload documents to prove identity by using the upload feature at the bottom of the web-form.
The document should be valid and include your name, date of birth (for proof of identity) and current address (for proof of address). If you have changed your name (if your name differs to that which we have on record), please supply relevant documents evidencing the change.
When will I receive a response to my request?
We will fulfil your request within one month of receiving it. If we need to verify your identity or clarify the nature of your request, this timeframe will pause until you provide us with the information we have asked for. If we ask you to verify your identity or to clarify the nature of the request, and we do not hear back from you within 30 days, we will cancel your request. In some exceptional circumstances we may apply a time extension, but we will let you know if this is the case.
Requests will be fulfilled using our data privacy portal, OneTrust. Please look out for any automated messages from OneTrust, which will provide you with instructions on how to access your data or to reply to any messages we send you in relation to your request.
Where can I find more information about my rights under the UK GDPR?
For more information about your rights under the UK GDPR, please visit the Information Commissioner’s Office (ICO).
Third Party Requests
If you are a statutory authority making a request for information, please submit your request using the button above and please upload a copy of this request form with your request.