Subject Access Requests

Subject access request

A subject access request (SAR) can be used by an individual to access personal data that is held about them, or someone they have authority to act on behalf of, by an organisation.

How do I submit a SAR?

If you wish to request personal information that is held about you, you will need to provide us with the following:

your contact details
a description of the information you seek
proof of your identity (copy of two of the following – passport, driving licence or birth certificate). This is so we can be reasonably certain that we only provide personal information to the individual who is entitled to receive it. Should you be unable to provide the above examples of identity, there are other options available (e.g. utility bills).

A SAR will only be valid if it contains all the information we need and we have received proof of your identity.

Our SAR form can be found here.

We cannot insist that you use this SAR form but it does include all the information that will help us deal with your request efficiently. If you choose not to use the SAR form, you should provide in writing (email or letter), all the information that the SAR form asks for and send it to our data protection officer.

Can somebody else submit a SAR for me?

Yes, if you are unable to submit a SAR yourself, you can instruct somebody else to do it for you. They will need to explain who they are, why they are making the SAR for you, provide proof of their identity, and proof of their authority to act on your behalf (eg a consent form). If there is no one who can help you submit your request please contact us and we can help make arrangements for somebody to assist you if necessary.

How much will it cost?

A SAR is free but, under the GDPR, we can charge a ‘reasonable fee’ when a request is ‘manifestly unfounded’ (clearly unreasonable). This also applies if a request is excessive and particularly if it is repetitive. We can also charge a reasonable fee to comply with requests for further copies of the same information.

What if the request is ‘manifestly unfounded’ or excessive?

Where requests are ‘manifestly unfounded’, excessive or repetitive, we can:

charge a reasonable fee taking into account the administrative costs of providing the information or,
refuse to process your request.

Where we refuse, we will tell you why and inform you of your right to complain without undue delay and at the latest within one month.

When will I receive the information?

We will normally provide the information within one month of receipt of a valid SAR. However, we are able to extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.

Checklist for submitting a SAR

Before submitting your SAR, please check the following:

have you provided your full name, address, telephone number and email address?
have you provided proof of your identity? (e.g. copy of two of the following – passport, driving licence or birth certificate).
have you provided enough information to help us identify and find the information that you are requesting? The more focused you can be, the better.
have you told us the format that you would like to receive the information in? (eg, electronically, hard copy or view on site).
if someone is making the request on your behalf, they must also provide proof of their identity and the authority they have to act on your behalf.

Can I always obtain information about myself?

Not always. There are a number of exemptions that might apply. If you make a SAR and we consider that the personal data concerned is exempt from disclosure then we will explain why. If you disagree with our view, you can ask us to reconsider or you can take the matter up with the Information Commissioner’s Office (ICO) which oversees compliance with this legislation.