Subject Access Request

SAR Process

The Subject Access request process is an integral part of our GDPR compliance process. We are committed to responding to SAR requests promptly and accurately. Our SAR process is defined in these simple steps:

• Receive and record the SAR
• Verify ID
• Process request
• Verify response
• Respond to subject
• Record and analyse

This is summarised in the chart below.

SAR Request Form

You should complete this form if you want us to supply you with a copy of any personal data we hold about you. You are entitled to receive this information under article 15 of the General Data Protection Regulation (GDPR). We will also provide you with information about any processing of your personal data that is being carried out, the retention periods which apply to your personal data and any rights to rectification, erasure, or restriction of processing that may exist.

We will endeavour to respond promptly and in any event within one month of the latest of the following:

• Our receipt of your written request; or
• Our receipt of any further information we may ask you to provide to enable us to comply with your request

The information you supply in this form will only be used for the purposes of identifying the personal data you are requesting and responding to your request. You are not obliged to complete this form to make a request, but doing so will make it easier for us to process your request quickly.

SECTION 1: Details of the person requesting information

These are the details of the person making the request:

• Full Name
• Address
• Contact Telephone
• Email Address

SECTION 2: If you are the data subject

To ensure we are releasing data to the right person we require you to provide us with proof of your identity and of your address. Please supply us with a photocopy or scanned image (do not send the originals) of one from both of the following categories:

• Proof of Identity: Passport, photo driving licence, national identity card, birth
• Proof of Address: Utility bill, bank statement, credit card statement (no more than 3 months old), current driving licence, current TV licence, local authority tax bill, HMRC tax document (no more than one year old).

If we are not satisfied that you are who you claim to be, we reserve the right to refuse to grant your request.

SECTION 3: If you are acting on behalf of the data subject

In order to respond to this request you need to enclose the data subject’s written authority and proof of the data subject’s identity and your own identity.

Acceptable forms of ID include:

• Proof of Identity: Passport, photo driving licence, national identity card, birth
• Proof of Address: Utility bill, bank statement, credit card statement (no more than 3 months old), current driving licence, current TV licence, local authority tax bill, HMRC tax document (no more than one year old).

If we are not satisfied that you are who you claim to be, we reserve the right to refuse to grant your request.

Data Subject’s details:

• Full Name
• Address
• Contact Telephone
• Email Address

SECTION 4: What information are you seeking?

Please describe the information you are seeking including any relevant details that you think will help us to identify the information you require. In addition, please specify if you want information about any of the following:

• Why we are processing your personal data
• To whom your personal data is disclosed
• The source of your personal data

Please note that if the information you request reveals details (directly or indirectly) about another person, we will have to seek the consent of that person before we can let you see that information.

In certain circumstances, where disclosure would adversely affect the rights and freedoms of others, we may not be able to disclose the information to you, in which case you will be informed promptly and given full reasons for that decision.

While in most cases we will be happy to provide you with copies of the information you request, we nevertheless reserve the right, in accordance with section 8(2) of the DPA, not to provide you with copies of information requested if to do so would take “disproportionate effort”. Also, in accordance with Article 12 of the GDPR, we may charge a fee or refuse the request if it is considered to be “manifestly unfounded or excessive”. However, we will make every effort to provide you with a satisfactory form of access or summary of information if suitable.

SECTION 5: Agreement

I confirm that I have read and understood the terms of this subject access form and certify that the information given is true. I understand that it is necessary to confirm my/the data subject’s identity and it may be necessary to obtain more detailed information in order to locate the correct personal data.

DOWNLOAD AS PDF DOCUMENT