How we wil fulfil your Subject Access Request
You have asked us for information/data we have about you. We will provide the data by following the law
relating to Subject Access Requests.
We will try to provide you with the data, but it may not always be possible because:
• it may be hard for us to find the data if it hasn’t been ‘filed’ under your name;
• some data can be withheld if, for example, if it is to do with our law enforcement work.
We may ask you for information to help us find your data. We will tell you if we decide to withhold data
from you.
We try to provide your data within one month. If your request is complex, we may take up to three months
– if this is the case we will let you know and explain why. We aim to keep you informed about our progress.
We will usually email you to:
1. Confirm that we have received your request and ask for proof of your ID. We will also confirm our
understanding of the data you want and the timetable by which we hope to provide it.
2. Let you know that we have done an initial search for your data. At this stage we may ask for some
more information to help us find what you want. If your request looks complex, we may also tell you
that we will have to work to the three-month deadline.
3. Give you the data we have found and explain if we have withheld any data and why.
Where data has been ‘filed’ under your name it is easy for us to find, e.g. data in our contact management
or staff records. It is harder to find your data in general systems such as email and file storage. We will
perform automated searches of these systems, but this has limitations. For example, we will search for
‘John Smith’ and check the data to make sure it is the right John Smith. We won’t search our systems just
for references to ‘John’ as this would return a disproportionate amount of data. If you think we hold
something specific, please tell us so we can focus our search.
We don’t give you correspondence you have sent to us or correspondence we have sent to you. We
assume that you already have this unless you request a specific item.
When we have found your data, we want to give it to you in a useable format. We also ensure that we are
not giving you names or data about other people. In order to do this, we will:
• Layout data into a format that could be read if printed.
• Where your data is stored with data about other people/topics, we either extract (cut & paste) it into
a new file, or we redact (black-out) the data/opinions of other people.
• Sometimes your name may appear in a logfile, but that log contains no other data about you. In this
case we will tell you how often your name appears.
• We will give you text data in a pdf, audio recording as mp3, or video recording as mp4. Please let
us know if you have accessibility issues and need different formats.
When we have sent your data please check it. If you think something is missing, and can give us more
information, we will search again.
Our staff who fulfil these requests are specialists. They are not involved in our primary regulatory work and
they make no judgement about why you want your data or other business you may have with us. They will
use their judgement to protect the privacy of other people and to ensure that the data is not exempt from
disclosure.
The privacy statement on our website gives more information about how we use data about people.
