Subject access request process
Under the GDPR any person (referred to throughout as the data subject) for whom the Parish Council hold personal data has the right to request information about the personal data held. This policy specifies how Carrington Parish Council will handle a subject access request (SAR) from a member of the public.
Who processes SARS?
The Clerk to the Council will process any SARs that are made. SARs can be made by any individual through the Parish Councils:
By email carringtonparishcouncil@gmail.com or,
In writing: Unit 25, Carrington Business Park, Manchester Road, Carrington, M31 4DD
What will happen next?
The Clerk will maintain a log of the location of personal data, this is to ensure that personal data is easily accessible at all times and can be deleted once the purpose of obtaining it has been fulfilled.
On receiving a SAR the Clerk will respond confirming that they have received the request and will direct the person to this policy so that they are aware of the next steps that will be taken. The Clerk will also forward the request on the Chair of the Parish Council.
After responding to the member of the public the Clerk will then do the following:
Verify whether you are controller of the data subject’s personal data. If you are not a controller, but merely a processor, inform the data subject and refer them to the actual controller.
Verify the identity of the data subject; if needed, request any further evidence on the identity of the data subject
Verity the access request; is it sufficiently substantiated? Is it clear to the data controller what personal data is requested? If not: request additional information.
Verify whether requests are unfounded or excessive (in particular because of their repetitive character); if so, you may refuse to act on the request or charge a reasonable fee.
Promptly acknowledge the validity of the SAR and inform the data subject of any costs involved in the processing of the SAR. The Clerk will ensure that a response to the SAR will be provided by one month of accepting the SAR as valid.
Verify whether you process the data requested by carrying out a full and exhaustive search.
If you do not process any data, inform the data subject accordingly.
Ensure data will not be changed as a result of the SAR. Routine changes as part of the processing activities concerned are permitted.
Verify whether the data requested also involves data on other data subjects and make sure this data is filtered before the requested data is supplied to the data subject; if data cannot be filtered, ensure that other data subjects have consented to the supply of their data as part of the SAR.
The Clerk will aim to provide a response to a SAR within one calendar month after the request is acknowledged as valid, however, If more time is needed to respond to complex requests, an extension of another two months is permissible, provided this is communicated to the data subject in a timely manner within the first month; if the council cannot provide the information requested, it should, inform the data subject on this decision without delay and at the latest within one month of receipt of the request.
What will be included in the SAR response?
The Clerk will ensure that the following information is included in the SAR response:
If data on the data subject is processed, make sure to include as a minimum the following information in the SAR response:
the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom personal data has been or will be disclosed, in particular in third countries or international organisations, including any appropriate safeguards for transfer of data, such as Binding Corporate Rules or EU model clauses;
where possible, the envisaged period for which personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
the right to lodge a complaint with the Information Commissioners Office (“ICO”);
if the data has not been collected from the data subject: the source of such data;
he existence of any automated decision-making, including profiling and any meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Provide a copy of the personal data undergoing processing.
What is the person is unhappy with the management of the SAR?
If the person is not happy with the management of the SAR this will be managed as a complaint against the Council and referred to the Information Commissioner for their consideration.
Online Subject Access Request Form
To ensure proper security, the Parish Council must be sure of your identity before complying with the subject access request. To confirm your identity, we need to see an official document with a photograph, such as a driving licence or a passport.
If you are making the request on behalf of another individual to access their information, we will need written consent from the individual to whom the data relates as well as your proof of identity. If you have legal authorisation to act on behalf of an individual, such as if you act with power of attorney or as a litigation friend, you will need to provide a copy of that authorization to evidence it.
We can refuse your request if it is manifestly unfounded or excessive, such as if it is repetitive. We will explain why we consider your request to be manifestly unfounded or excessive if we do refuse it.
Accepted Documents that provide proof of identity
The Parish Council will need to obtain copies of documents that prove the requesters identity. The following documents are acceptable for proof of identity (* These documents must be dated in the past 12 months, +These documents must be dated in the past 3 months):
Current UK/EEA Passport
UK Photocard Driving Licence (Full or Provisional)
Full UK Paper Driving Licence
Financial Statement issued by bank, building society or credit card company
Judiciary Document such as a Notice of Hearing, Summons or Court Order
Utility bill for supply of gas, electric, water or telephone landline+
Most recent Mortgage Statement
Most recent council Tax Bill/Demand or Statement
Tenancy Agreement