Complaints Policy for Subject Access Requests (SAR’s)

1. Introduction

The data protection legislation provides you with a right of access to obtain copies of your personal data which are held by our organisation. This is known as a subject access request (SAR).  The organisation makes every effort to ensure that SAR’s are answered promptly and professionally. However, if you are not satisfied, you have the right to complain about the response that you have received or the way we have handled your request. 

In this policy, ‘complaint’ refers to an expression of dissatisfaction with our organisation’s application of data protection legislation, or a request for a review into the way we have handled your request or the outcome of your request to access your personal data. We will apply an internal review procedure for complaints received regarding SAR’s.

2. What can I do if I think my personal information held by the organisation is incorrect?

If you think the information we hold is incorrect, please contact us as soon as possible in writing  (see address and email contact details in below section) and ask us to review the accuracy of the data so we can ensure your data is up to date and accurate. Further information on your data rights can be found on our website. 

3. How can I complain and request a review? 

You must put your complaint and request for an internal review in writing. You can download a complaints template by clicking here.

You can submit your complaint by post or by email. Contact details can be found at the bottom of the page.

As an alternative you can complete an online form by clicking here.

Your request should be made within 40 working days after receipt of our initial response to your SAR. We are not obliged to accept an internal review request after this date and unless there are extenuating circumstances, requests made more than 40 working days after the response will not be considered. 

Please explain clearly, with as much detail as possible, what you are disputing about the original decision reached in response to your SAR, or why you are dissatisfied with the handling of your request. If you think personal information is missing from the response that was provided to you, please let us know what other information you think we also have. This will help us to review our records. 

The internal review process can only review and consider the scope of the original SAR which was made to us. If you wish to make amendments to the scope or ask for additional information, a further SAR should be made to our organisation.

4. What happens next?

Your request for a review of our response will be considered free of charge.  It will be acknowledged promptly, usually within 5 working days of receipt.  Our acknowledgement letter will confirm the target date for a response.   If clarification is required from you e.g. it is not clear what you are dissatisfied with, the response period will not begin until clarification is received. 

Once an internal review request is accepted as valid, our organisation will aim to respond within 30 days from the day after the internal review request was received. It should be noted that this timeframe is currently not a legislative requirement, and we may need additional time to complete the internal review. We will contact you to inform you if that is the case and will confirm what date you will receive a response by.  

Reviews will be dealt with in a fair, thorough and impartial manner. As such the review will be carried out by an individual who did not deal with your original request. 

The review will take a fresh look at the SAR and may also seek guidance from the Information Commissioner’s Office (ICO). It will re-evaluate the handling of the original request reviewing decisions made regarding what information would be disclosed, and particular attention will be paid to any concerns raised by you. As part of this process, the reviewing individual may need to consult with the original responding officer as to how and why previous decisions were made. However, the reviewing individual is not bound by any views expressed by those who dealt with the original request, the views will simply be treated as background information rather than a suggestion as to how to handle the review.

The reviewing individual will decide about the validity of any exemptions applied. Different or additional exemptions may also be applied on review. A response, in writing, will be provided to let you know the outcome of the review, giving a full explanation of the decision reached. 

5. Possible outcomes and potential actions that could be taken:

1.)    Information that was previously withheld should be disclosed:

The information in question will be provided, usually at the same time as the review decision, or, if that is not possible, you will be informed how soon this will be provided. 

2.)    Further information is identified which was not considered as part of the original response: 

This will be provided to you, or, if any exemptions apply this will be explained to you and the information redacted / withheld accordingly. 

3.)    Procedures have not been properly followed by our organisation:

The complaint will be upheld and an apology will be offered. Appropriate steps will be taken to learn lessons and prevent similar issues occurring in future. 

4.)    The initial decision to withhold information is upheld, or otherwise, in our organisation’s favour:

You will be informed of the decision and the reasons for this. Please note that abuse of the review procedure, such as repeated requests for review following every request made, may be treated as vexatious.

6. What can I do if I am not satisfied with the response to the complaint?

You have the right to appeal to the Information Commissioner’s Office (ICO) and ask them to review our responses. The ICO are the UK’s independent body that oversees information rights including those set out in the data protection legislation.  Details of how to contact the ICO are given at the bottom of the previous page.