Subject Access Request Procedure

Version	Purpose/Change	Author	Date
1.0	Initial version	Will Harries	01/08/2017
1.0	Reviewed	Will Harries	27/01/2020
1.1	Reviewed Updated contact details	Will Harries	03/02/2021
1.2	Reviewed	Jessie Kazak	15.3.24

Requires review: 15.3.26

Definitions

ICO	Information Commissioners Office
DPO	Data Protection Officer
GDPR	General Data Protection Regulations
SAR	Subject Access Request

Summary

Individuals have the right to access the personal data and supplementary information the Kindergarten holds about them. This allows them to be aware of, and verify the lawfulness of, the Kindergarten processing this data.

This right applies to everyone whose personal data the Kindergarten holds, including staff, Trustees, volunteers, parents, carers and children.

This right can be exercised by submitting a Subject Access Request. The SAR form is available on the website.

This document describes the process that will be undertaken when a SAR is received.

Lawful Basis

Under the GDPR, we:

must provide the information free of charge

must comply within 1 month

should provide the information in a commonly used electronic format, if the request was made electronically

Who deals with subject access requests?

The Kindergarten’s DPO will deal with all subject access requests received. This is based on advice from the ICO’s guidance.

How we will respond to subject access requests

On receiving a request, our DPO will review the SAR form. They will contact the person making the request if insufficient information has been submitted, or two forms of identification have not been provided.

In most cases, we will provide the information within 1 month, and free of charge. If the request is complex or numerous, we can comply within 3 months, but we will inform the individual of this within 1 month and explain why the extension is necessary.

If the request is made electronically, we will provide the information in a commonly used electronic format.

We recognise that Kindergarten holidays are counted in the response time and if we receive a request in the Kindergarten holidays, we will still respond within the same time frame.

‘Unfounded or excessive’ requests

If the request is unfounded or excessive, we will either:

charge a reasonable fee for us to comply, based on the administrative cost of providing the information

refuse to respond

comply within 3 months, rather than the usual deadline of 1 month; however, we will always inform the individual of this and will explain why

Usually, ‘unfounded or excessive’ means that the request is repetitive, or asks for further copies of the same information.

Refusing a request

When we refuse a request, we will:

respond to it within 1 month

explain why we are refusing the request

inform the individual that they have the right to complain to the ICO

Further Information

If you would like to discuss anything in this procedures document, please contact our DPO:

Data Protection c/o Laurel Farm Kindergarten Administrator: email admin@laurelfarmkindergarten.co.uk