Introduction

Individuals, also known as data subjects, have the right to access personal data held on them by St Stephen in Brannel Parish Council.

Personal Data is any information about a living individual which allows them to be identified from that data (for example a name, photographs, videos, email address, or address). Identification can be by the personal data alone or in conjunction with any other personal data. The processing of personal data is governed by legislation relating to personal data which applies in the United Kingdom including the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA) and other legislation relating to personal data and rights such as the Human Rights Act 1998.

Further details are set out in the General Privacy Notice, which is available on the Parish Council’s website or from the Parish Council office.

This policy advises of the internal process for the handling of Subject Access Requests (SARs) and includes information on:

  • Responsibilities
  • Timing
  • Changes to data; and
  • Handling requests for rectification, erasure, or restriction of processing.

St Stephen in Brannel Parish Council will take reasonable stops to ensure that personal data is easily accessible, to enable a timely response to SARs, and that personal data on specific data subjects can be easily filtered.

 Upon receipt of a Subject Access Request (SAR)

  1. a) A SAR may be made verbally, in writing, by email or by other electronic means. It will be confirmed whether the Parish Council processes the data subject’s personal data. Once verified, the Data Subject will be informed who at the Parish Council to contact regarding the handling of their SAR. This will normally be the Clerk who has been appointed as the Data Protection Officer.
  2. b) The identity of the requester will be verified only where necessary and proportionate, and further evidence may be requested where the Council has reasonable doubt as to identity.
  3. c) The SAR will be assessed to confirm whether it is sufficiently clear. If further information is needed to identify the data requested, the requester will be asked to clarify the request.
  4. d) Requests will be verified to check if they are unfounded or excessive (in particular because of their repetitive character). If they are, the Parish Council may refuse to act on the request or charge a reasonable fee and will explain its decision to the requester.
  5. e) Receipt of the SAR will be promptly acknowledged, and the data subject will be informed of any costs involved in the processing of the SAR.
  6. f) Whether the Parish Council processes the data requested will be confirmed. If the Council does not hold or process any relevant data, the requester will be informed accordingly. At all times, this policy will be followed, and progress may be monitored.
  7. g) Data must not be altered because of the SAR. Routine changes made as part of ordinary processing may continue in the normal course of business.
  8. h) The data requested will be reviewed to establish whether it contains information about other data subjects. Where appropriate, this information will be redacted before the requested data is supplied. If redaction is not possible, the Council will consider whether disclosure is lawful and appropriate in the circumstances.

 

Responding to a Subject Access Request

  1. a) The Parish Council will respond to a SAR within one calendar month after receipt of the request. The clock starts from the day after receipt of the request, or after identity has been verified:
  2. If more time is needed to respond to complex requests, an extension of another two months is permissible, and this will be communicated to the Data Subject in a timely manner within the first month.
  3. If the Parish Council cannot provide the information requested, it will inform the Data Subject on this decision without delay and, at the latest, within one calendar month of receipt of the request. If a request is refused, a written explanation and information about how to complain will be provided.
  4. b) If a SAR is submitted electronically, any personal data will normally be provided by electronic means unless the requester asks otherwise or another format is more appropriate.
  5. c) If data on the Data Subject is processed, the Parish Council will ensure, as a minimum, the following information is included within the SAR response:
  6. the purposes of the processing.
  7. the categories of personal data concerned.

iii. the recipients or categories of recipients to whom personal data has been or will be disclosed where applicable;

  1. where possible, the envisaged period for which personal data will be stored, or, if not possible, the criteria used to determine that period.
  2. the existence of the right to request rectification or erasure of personal data, or restriction of processing of personal data concerning the Data Subject or to object to such processing.
  3. the right to lodge a complaint with the Information Commissioners Office (the ICO).

vii. if the data has not been collected from the Data Subject: the source of such data.

viii. the existence of any automated decision-making, including profiling and any meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

  1. d) the Parish Council will provide a copy of the personal data undergoing processing unless an exemption applies.

  

Implementing the Subject Access Requests Policy

On receipt of a SAR, it must be forwarded immediately to the Clerk/DPO, who will coordinate the response and, where necessary, refer the matter to the Finance & Policy Committee. The Clerk/DPO must ensure the request has been received and, where necessary, may seek clarification as to the personal data requested., Where identity needs to be verified, the Council may request reasonable evidence of identity and address. The Parish Council accepts the following forms of identification:

 

  • Current UK/EEA Passport
  • UK Photocard Driving Licence (Full or Provisional)
  • Firearms Licence/Shotgun Certificate
  • EEA National Identity Card
  • Full UK Paper Driving Licence
  • State Benefits Entitlement Document*
  • State Pension Entitlement Document*
  • HMRC Tax Credit Document*
  • Local Authority Benefit Document*
  • State/Local Authority Educational Grant Document*
  • HMRC Tax Notification Document
  • Disabled Driver’s Pass
  • Financial Statement issued by bank, building society or credit card company+
  • Judiciary Document such as a Notice of Hearing, Summons or Court Order
  • Utility bill for supply of gas, electric, water or telephone landline+
  • Most recent Mortgage Statement
  • Most recent Council Tax Bill/Demand or Statement
  • Tenancy Agreement
  • Building Society Passbook which shows a transaction in the last 3 months and your address

 

(*These documents must be dated in the past 12 months;

+These documents must be dated in the past 3 months)

 

  1. All Parish Councillors and staff who are asked to locate and supply personal data relating to a SAR must make a full and reasonable search of the records to which they have access. All personal data that has been requested must be provided unless an exemption applies. This may involve a search of emails, recoverable emails, mobile phone texts, social media posts, word documents, spreadsheets, databases, systems, removable media, tape recordings and paper records held in relevant filing systems. A response must be provided within one calendar month of receipt of the request, subject to any lawful extension. The Parish Council must provide, where necessary, an explanation with the personal data in an “intelligible form”, which will include explaining any codes, acronyms, and complex terms. The personal data will be supplied in a permanent form unless the requester agrees otherwise, or where it is impossible or would involve disproportionate effort. Agreement may be sought with the requestor that they will view the personal data on screen or inspect files on Council premises.
  2. Any exempt personal data will be redacted from the released documents with an explanation why that personal data is being withheld. Redaction will be conducted using secure methods with an audit trail.
  3. SARs will be undertaken free of charge to the requestor unless the legislation permits reasonable fees to be charged. Fees will be applied only where allowed by Article 12(5) of the UK GDPR.
  4. The Clerk and Human Resources Committee must ensure that all staff are aware of and follow this policy.

 

The personal data will be supplied in a permanent form unless the requester agrees otherwise, or where it is impossible or would involve disproportionate effort.

[1] Adopted by Full Council at the meeting held on Wednesday 12th August 2026 under minute number FPC142/26. Due for review in 2029.