Under the GDPR, a request for personal information is free.

If however the request is deemed to be ‘manifestly unfounded or excessive' or for multiple requests, we can charge a ‘reasonable fee’ to cover the processing costs. Should this be necessary, we will notify the requester within a month of receipt of the request, explaining why the fee is necessary.

Yes they can – but only with evidence of your permission to do so.

If a parent, family member or anyone else claiming to be connected to you asks us for copies of your personal information, we will always say no, unless they can prove that they are acting on your behalf:

• Their requests must be accompanied by a copy of written authority from you or with legal written authority such as Power of Attorney (if applicable).
• The the requester will still need to provide proof of your identity.

Under the GDPR, we must respond to SARs within one calendar month of receipt. This deadline can be extended by a further two months where there are a number of requests or the request is complex, but we must notify the requester within a month of receipt of the request, explaining why the extension is necessary.

You will always receive an acknowledgement from us, so if you haven’t received one within 5 days of sending your request, check you junk mail or post and if there’s nothing there, give us a call or mail us again. It may be that we haven’t received it or it’s been accidentally filed as “spam”.    

If you’ve emailed someone and received an out of office response asking you to direct it to another address, it’s your responsibility to ensure that you forward it, otherwise we won’t consider the request “received” until that original email has been received.

The legal definition of Personal data is “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Basically it’s any information we hold about you that can be used to identify you. It can take a number of forms such as a paper document, an electronic file, email or entry on a database and things like CCTV footage, a picture or even an audio recording.  It could also be something like an opinion of others about you (if it’s recorded somewhere) such as a reference.

A name in isolation does not necessarily make something personal though. Jon Doe could be anyone of that name, so just because a name appears in an email, it’s not always “about you”.

We will endeavour to provide you with everything you have requested, but on occasion there may be a legal reason why we can’t.  

It may be that the information you have requested included references to other people that you are not entitled to see, in that situation, we would redact (black out) certain parts of the information. In extreme circumstances where redacting cannot satisfy the rights of others to not have their data disclosed, we may need to withhold completely.

If it’s reasonable for us to do so, we might speak to the other party and ask their permission to disclose – if they say yes, we will.

There may be other exemptions under European or UK law that prohibit disclosure of information. If there are, we will explain them to you in full when we respond.

We will always try to send you the information in the manner you have requested us to. So if you want it sent electronically via email, we will send it to you that way, but we will always ensure that appropriate security precautions are taken, so an email may contain an encrypted response.

If you want it sent by post, even on a USB, we will send by recorded or special delivery. 

You may can even arrange to come and pick it up of you prefer.

If you received an acknowledgement, but we don’t follow it up with a response within a month, then please contact us. It’s unlikely to happen, but it’s always possible that your email account has rejected our reply due to its size and we're not aware of it, or something’s happened to delay the delivery.

If we’re responding by post, please allow a day or two for the letter or parcel to arrive.