Data Subject Access Request

Under the General Data Protection Regulation (GDPR) we have a duty to provide you with information we hold about you.

Our Privacy Statements explain how we process this information. 

GDPR provides the following rights for individuals:

• The right to be informed. This is the information given to you in a privacy notice
• The right of access. You can ask to see the personal information we hold about you. This is known as a 'Subject Access Request'
• The right to rectification. If you feel your information is incorrect you can ask for it to be corrected
• The right to erase. In some cases you can ask for your personal information to be erased (removed from our systems)
• The right to restrict processing. In some cases you can ask for the processing of your personal information to be restricted
• The right to data portability. You can ask to acquire and reuse your personal information for your own purposes
• The right to object. You can object to processing if you feel your personal information is not being used for the purpose you gave it to us for
• Rights in relation to automated decision making and profiling. You have the right to know if your personal information is used in an automated process which could result in a decision being made about you.  

You can request any of the above by completing a Data Subject Access Request form. 

Your right to access is known as a 'Subject Access Request' (SAR). This means you can request all or specific information we hold on you. 

Request information

To request information, complete the Data Subject Access Request form (PDF, 195 KB).

You can also make a request to us in writing or verbally. 

Please tell us if you want specific information. For example, if you want access to something the Council sent you, you can say when you think it was sent and who from. 

Information we can't give

In most cases we will be able to give you the information we hold on you. There may be times where we:

• need to remove certain information (e.g because it relates to someone else); or
• apply an exemption and provide you with the information

If this happens we will explain why we have made our decision. 

Requesting information held about other people

You can't request information about another person unless you:

• have parental responsibility for a child; or 
• are a legal representative and have written authority to request this information

We need proof of consent before we can process your request. 

More information is available on the Data Subject Access Form. 

Delay in response

We aim to provide you with all the information within 1 month. However, we can extend the deadline by a further 2 months. We may need to do this if a large amount of data is held on you across different teams. To help us process your information quickly, please tell us the specific information you need. 

Receiving your response

We usually provide a response by email or post. You can say how you would prefer to receive the response when you make your request.

To ensure we send response data to you securely, we will:

• password protect documents sent by email
• post documents by recorded delivery 

How long your SAR data will be kept

Your request and response will be kept for 2 years as part of our Data Retention policy. Any identification sent to us as part of a SAR will be destroyed as soon as we have fulfilled our purpose of verification.