Subject Access Request

A Subject Access Request (SAR) is a request for personal information held by an organisation. It's a right that anyone can exercise.

You have the right to obtain a copy of your personal data as well as other supplementary information held by Lanarkshire Carers. It helps you to understand how and why Lanarkshire Carers is using your data, and the lawful basis for capturing and processing. You have the right to obtain the following:     

• confirmation that Lanarkshire Carers is processing your personal data;
• a copy of your personal data; and
• other relevant supplementary information held by us relating to you

You are only entitled to your own personal data, and not to information relating to other individuals (unless the information is also about you or you are acting on behalf of someone).  In addition to a copy of your personal data, Lanarkshire Carers will also provide you with the following information:

• the purposes of the processing
• the categories of personal data concerned
• any third party that the organisation discloses your personal data to
• Our retention period for storing the personal data
• the existence of the individuals right to request rectification, erasure or restriction or to object to such processing
• the right to lodge a complaint with the ICO or another supervisory authority
• information about the source of the data, where it was not obtained directly from you

Processing:  timescales and fees

In most cases Lanarkshire Carers will not charge a fee to comply with a subject access request.  However where the request is manifestly unfounded or excessive we may charge a reasonable fee for the administrative costs of complying with the request. A reasonable fee, based on the administration cost, will be charged if you request further copies of your data following a request.

Lanarkshire Carers will act on a Subject Access Request without undue delay and at the latest within one month of receipt.  This timescale will be calculated from the day after we receive the request (whether the day after is a working day or not) until the corresponding calendar date in the next month.  If this is not possible because the following month is shorter (and there is no corresponding calendar date), the date for response is the last day of the following month. If the corresponding date falls on a weekend or a public holiday, we will respond on the next working day.

Exceptions: Lanarkshire Carers may extend the time to respond by a further two months if the request is complex or a number of requests from you are received. The person requesting the information will be informed within the one month period that an extension is required and the reason(s) why.                               

Proof of identity

If Lanarkshire Carers has any doubts about the identity of the individual making the request, we may require more information or proof of identity. We will inform you that more information is required and ask you to confirm your identity before responding to your request. The timescale for responding to the request begins when we receive the additional information requested.

Access requests made on behalf of others

The GDPR does not prevent an individual making a subject access request via a third party. Often, this will be a solicitor acting on behalf of a client, but it could simply be that an individual feels comfortable allowing someone else to act for them. In these cases, Lanarkshire Carers needs to be satisfied that the third party making the request is entitled to act on your behalf. This may mean we need to verify the request with you directly, but it is the third party’s responsibility to provide evidence of this entitlement. If Lanarkshire Carers decides that you may not understand what information would be disclosed to a third party, who has made a subject access request on your behalf, we may send the response directly to you rather than to the third party. You may then choose to share the information with the third party after having had a chance to review it.

If an access request includes information about other individuals

Responding to a subject access request may involve providing information that relates both to the individual making the request and to another individual. The DPA 2018  says that we do not have to comply with the request if it would mean disclosing information about another individual who can be identified from that information, except if:

• the other individual has consented to the disclosure
• it is reasonable to comply with the request without that individual’s consent.

Access requests – refusal to comply

Lanarkshire Carers may refuse to comply with a subject access request if it is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature. If we do refuse to comply with a request, you will be informed within one month of receipt of the request, informing you of the undernoted:

• the reasons we are not complying with the access request
• your right to make a complaint to the ICO or another supervisory authority
• your ability to seek to enforce this right through a judicial remedy.

How to make a Subject Access Request

You can make a Subject Access Request with Lanarkshire Carers either verbally or in writing, including via our website and social media channels. Please visit our contact page for ways to get in touch with us. 

You can ask a third party (eg a relative, friend or solicitor) to make a Subject Access Request on your behalf. Before responding, we need to be satisfied that the third party making the request is entitled to act on your behalf. We may need to verify this by contacting you direclty.  It is the third party’s responsibility to provide evidence of their authority.