Subject Access Requests

The Data Protection Act 2018 (the DPA) gives you a right to access the information Isle of Wight Council holds about you. These requests are known as Subject Access Requests or SARs.

If you require access to adoption records, this is a separate process. Our 'If you are adopted' information provides details on how to access adoption records.

Subject Access Requests can be made:

  1. Send us your SAR request by email: information@iow.gov.uk

Proof of identity

To verify your identity and to ensure that your information is only disclosed to you, you will need to provide us with copies of the following:

  • Proof of identity, like a copy of your passport, driving licence, or other document showing  your name and signature
  • Copy of a household bill within the last 3 months, like a council tax or utility bill, showing your name and address
  • If you are making a request on behalf of someone else, we will ask for evidence showing your entitlement or authority to do so.

Response time

We will aim to provide you with a response to your request within one calendar month.

This timescale can be extended by a further two months where requests are complex or numerous. If this is the case, we will inform you within one month of the receipt of your SAR and explain why the extension is necessary.

Where requests are manifestly unfounded or excessive, in particular because they are repetitive, the council has the right to refuse to respond.

In addition to the right of access, the General Data Protection Regulation (GDPR) provides the following rights for individuals:

  • The right to be informed.
  • The right of access.
  • The right to rectification.
  • The right to erasure.
  • The right to restrict processing.
  • The right to data portability.
  • The right to object.
  • Rights in relation to automated decision making and profiling.

The Information Commissioner, who oversees compliance and promotes good practice, requires all organisations, and individuals, who process personal data, to comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This data protection legislation includes 6 principles that requires personal data to be:

  1. processed lawfully, fairly and in a transparent manner in relation to individuals;  privacy notices must be issued when data is collected to let individuals know why their information is needed, what it will be used for and who it will be shared with.
  2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
  3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
  4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
  5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals.
  6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

Further information

 

In this section