Subject Access Requests
Subject Access Requests (SAR)
Under the General Data Data Protection Regulation (GDPR) an individual has the right to request all personal data that an organisation holds about them by making a Subject Access Request (SAR).
You can make a request to access your personal information by emailing us at firstname.lastname@example.org or by sending a letter in the post to:
Customer Care Team
Before you do please take the time to read the SAR guidance information.
Information you need to provide
1. A clear, specific request
The Council does not have to start working on a subject access request until you have provided enough information for us to find the personal data.
For example, a request for 'all of the personal data held on me' is not specific enough for us to find your personal data.
The Council processes personal information for many reasons, below is a list of the most requested information types:
- social care information
- housing benefit files
- council tax information
- employment files
You will need to state which Council departments you have dealt with.
If you are requesting social care information then please provide details of any family members who were also involved with social care. This will allow us to conduct a more thorough search of our social care records and allow us to provide you with more information
2. Current identification
The Council takes great care to ensure that personal data is only disclosed to those who are authorised to access it. For this reason you will need to provide a form of ID from each of the lists below in order to request your personal information.
Examples of acceptable name identification:
- driver's license
- birth certificate
- council tax bill
Examples of acceptable proof of address:
- utility bill
- bank statement
Address ID is necessary in order to ensure that your personal data is being posted to the right place. If you would rather pick up your data by hand then please let us know.
How long does a subject access request take
The General Data Protection Regulation gives data controllers one month to complete a subject access request. This time starts from when the Council receives a clear request and enough identification to be sure that the request is from the data subject.
Some social care files are very large and may take longer than a month to complete. If this is the case with your request we will contact you.
Children Social Care
Subject access requests relating to children's services are completed by Achieving for Children. For more information, or to request copies of information held by Achieving for Children about yourself or a child, please visit their webpage Achieving for Children.
If some or all of my request is refused
The Council is permitted to withhold information if it falls under one of the exemptions in the Act. If you are unhappy with the decision, you can write to the Information Commissioner to request a review of that decision.
What if I am not happy with the response to my request?
The first stage is to contact us to request a review of your request. The General Data Protection Regulation does not specify how long a review should take but in most cases the Council will attempt to review your request within 20 working days.
If you are still unsatisfied after a review then the next stage is to contact the Information Commissioner's Office (ICO):
Information Commissioner's Office
Tel: 0303 123 1113