Subject Access Request Policy

 Subject Access Request Policy

What we will do?

  1. On receipt of a subject access request it will be forwarded immediately to The Ponteland Town Council’s Data Protection Officer
  2. He/she must correctly identify whether a request has been made under the Data Protection legislation
  3. A member of staff, and as appropriate, councillor, who receives a request to locate and supply personal data relating to a SAR must make a full exhaustive search of the records to which they have access.
  4. All the personal data that has been requested must be provided unless an exemption can be applied.
  5. PTC will respond within one calendar month after accepting the request as valid.
  6. Subject Access Requests will be undertaken free of charge to the requestor unless the legislation permits reasonable fees to be charged.
  7. Councillors and managers will ensure that the staff they manage are aware of and follow this guidance.
  8. Where a requestor is not satisfied with a response to a SAR, the council will manage this as a complaint.

How we will do it?

  1. We will notify the Data Protection Officer upon receipt of a request.
  2. We will ensure a request has been received in writing where a data subject is asking for sufficiently well-defined personal data held by the council relating to the data subject. You will clarify with the requestor what personal data they need.

They must supply their address and valid evidence to prove their identity. The council accepts the following forms of identification (* These documents must be dated in the past 12 months, +These documents must be dated in the past 3 months):

Current UK/EEA Passport

UK Photocard Driving Licence (Full or Provisional)

Firearms Licence / Shotgun Certificate

EEA National Identity Card

Full UK Paper Driving Licence

State Benefits Entitlement Document*

State Pension Entitlement Document*

HMRC Tax Credit Document*

Local Authority Benefit Document*

State/Local Authority Educational Grant Document*

HMRC Tax Notification Document

Disabled Driver’s Pass

Financial Statement issued by bank, building society or credit card company+

Judiciary Document such as a Notice of Hearing, Summons or Court Order

Utility bill for supply of gas, electric, water or telephone landline+

Most recent Mortgage Statement

Most recent council Tax Bill/Demand or Statement

Tenancy Agreement

Building Society Passbook which shows a transaction in the last 3 months and your address

  1. Depending on the degree to which personal data is organised and structured, we will need to search emails (including archived emails and those that have been deleted but are still recoverable), Word documents, spreadsheets, databases, systems, removable media (for example, memory sticks, floppy disks, CDs), tape recordings, paper records in relevant filing systems etc. which your we are responsible for or own.
  2. PTC will not withhold personal data because we believe it will be misunderstood; instead, we will provide an explanation with the personal data. We will provide the personal data in an “intelligible form”, which includes giving an explanation of any codes, acronyms and complex terms. The personal data will be supplied in a permanent form except where the person agrees or where it is impossible or would involve undue effort. We may be able to agree with the requester that they will view the personal data on screen or inspect files on our premises. We may redact any exempt personal data from the released documents and explain why that personal data is being withheld.
  3. This policy is clear on forms and on the council website
  4. PTC do this through the use of induction, my performance and training, as well as through establishing and maintaining appropriate day to day working practices.
  5. A database is maintained allowing the council to report on the volume of requests and compliance against the statutory timescale.
  6. When responding to a complaint, we will advise the requestor that they may complain to the Information Commissioners Office (“ICO”) if they remain unhappy with the outcome.
  7. Ponteland Town Council will Respond to a SAR within one month after receipt of the request:
  • If more time is needed to respond to complex requests, an extension of another two months is permissible, provided this is communicated to the data subject in a timely manner within the first month;
  • if the council cannot provide the information requested, it should inform the data subject on this decision without delay and at the latest within one month of receipt of the request.
  1. If a SAR is submitted in electronic form, any personal data should preferably be provided by electronic means as well.
  2. If data on the data subject is processed, make sure to include as a minimum the following information in the SAR response:
  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom personal data has been or will be disclosed, in particular in third countries or international organisations, including any appropriate safeguards for transfer of data, such as Binding Corporate Rules[1] or EU model clauses[2];
  • where possible, the envisaged period for which personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;