Subject Access Requests (SAR)

Under the General Data Data Protection Regulation (GDPR) an individual has the right to request all personal data that an organisation holds about them by making a Subject Access Request (SAR). 

You can make a request to access your personal information by emailing us at sar@kingston.gov.uk or by sending a letter in the post to:

Information Governance Team

Guildhall 2
Kingston Council
High Street
Kingston
KT1 1EU

Before you do please take the time to read the SAR guidance information.

Information you need to provide

A clear, specific request

The Council does not have to start working on a subject access request until you have provided enough information for us to find the personal data.

For example, a request for 'all of the personal data held on me' is not specific enough for us to find your personal data.

The Council processes personal information for many reasons, below is a list of the most requested information types:

• social care information
• housing benefit files
• council tax information
• employment files

You will need to state which Council departments you have dealt with.

If you are requesting social care information then please provide details of any family members who were also involved with social care. This will allow us to conduct a more thorough search of our social care records and allow us to provide you with more information

Current identification

The Council takes great care to ensure that personal data is only disclosed to those who are authorised to access it. For this reason you will need to provide a form of ID from each of the lists below in order to request your personal information.

Examples of acceptable name identification:

• driver's license
• passport
• birth certificate
• council tax bill

Examples of acceptable proof of address:

• utility bill
• bank statement

Address ID is necessary in order to ensure that your personal data is being posted to the right place. If you would rather pick up your data by hand then please let us know.

How long a subject access request takes

The General Data Protection Regulation gives data controllers one month to complete a subject access request. This time starts from when the Council receives a clear request and enough identification to be sure that the request is from the data subject.

Some social care files are very large and may take longer than a month to complete. If this is the case with your request we will contact you.  

Children's social care

Subject access requests relating to children's services are completed by Achieving for Children. For more information, or to request copies of information held by Achieving for Children about yourself or a child, please visit their webpage Achieving for Children.

If some or all of your request is refused

The Council is permitted to withhold information if it falls under one of the exemptions in the Act. If you are unhappy with the decision, you can write to the Information Commissioner to request a review of that decision.

If you're not happy with the response to your request

The first stage is to contact us to request a review of your request. The General Data Protection Regulation does not specify how long a review should take but in most cases the Council will attempt to review your request within 20 working days.

If you are still unsatisfied after a review then the next stage is to contact the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113