Policies and Procedures

Subject Access Request (February 2026)

CROWLAND PARISH COUNCIL

Subject Access Request (SAR)

Purpose

To ensure Subject Access Requests are handled lawfully and within timescales in accordance with UK GDPR and the Data Protection Act 2018.

What is a SAR?

A Subject Access Request is a request from an individual to access their personal data held by the Council. Requests can be verbal or written and do not need to mention data protection law.

Who Is Responsible?

  • The Clerk (Proper Officer) coordinates all SARs.
  • Any councillor or staff member receiving a SAR must forward it immediately to the Clerk.
  • Advice may be sought from the Council’s DPO or data protection adviser if required.

Step‑by‑Step Process

  1. Receive the Request
    • Accept SARs in any format (email, letter, verbal, social media).
    • Note the date received.
  2. Verify Identity
    • Confirm the requester’s identity before releasing data.
    • Request reasonable ID if necessary.
    • The response deadline starts once identity is confirmed.
  3. Acknowledge
    • Acknowledge receipt promptly.
    • Confirm the response deadline.
  4. Locate the Data
    • Search all relevant systems and records (emails, files, minutes, paper records).
    • Councillors must cooperate promptly with data searches.
  5. Review & Redact
    • Check data carefully before disclosure.
    • Remove third‑party personal data unless consent is given or disclosure is reasonable.
    • Withhold exempt information (e.g. legally privileged material).
  6. Respond
    • Provide the data and required information clearly and securely.
    • Responses should normally be provided electronically.

Timescales

  • Respond within one calendar month.
  • May extend by up to two further months for complex requests (inform the requester within the first month).

Fees

  • SARs are normally free of charge.
  • A reasonable fee may be charged for manifestly unfounded or excessive requests, or additional copies.

Refusals

  • If refusing all or part of a SAR, explain the reason in writing.
  • Inform the requester of their right to complain to the Information Commissioner’s Office (ICO).

Record Keeping

  • Log all SARs, including dates, actions taken, and response issued.
  • Retain records in line with the Council’s retention policy.

Adopted/Reviewed by the Parish Council: 2nd February 2026

Next Review Date: 2nd February 2027