Your rights to your personal information
When it comes to the use of your personal information, the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR) (pdf 960KB) both include a number of rights for individuals:
- What you can do - your rights
- Access Requests
- How to raise a concern about our use of your personal information
These rights are not automatic but in certain circumstances you have the right to:
- ask if your personal information is being used by us and access the personal information held about you
- ask for your personal information to be corrected or updated
- request for your personal data to be erased - we will comply with this request in certain circumstances, for example, if you initially consented to the use of your personal information but have now withdrawn that consent
- withdraw your consent to the use of your personal information
- ask us to transfer your personal information directly to another data controller - this applies to personal information that is held electronically
- ask us to restrict your personal information if there is a dispute as to the accuracy or processing of your personal information - this means your personal information won't be used except in limited circumstances
- object to the use of your personal information and request we stop using your personal information
- lodge a complaint with the Information Commissioner's Office
The Data Protection Act and the GDPR both include the right for an individual to access personal data that an organisation holds about them. This right of access extends to all information held on an individual except where a valid exemption (or restriction) applies. If an individual makes a request to view their information, it is known as an 'Access Request' or 'Subject Access Request' (SAR).
To make an Access Request, you must:
- submit your request
- supply information to prove who you are (to eliminate risk of unauthorised disclosure)
- supply appropriate information to help the council to locate the information you require
Your request should include details and provide evidence of who you are (for example driving licence, passport, birth certificate, utility bills). You should also provide as much detail as possible regarding the information you wish to access (for example where and by whom information is believed to be held and specific details of information required).
Please note that we won't be able to comply with any requests received unless you provide a satisfactory proof of identification.
There is no charge for making an Access Request, except where the request is manifestly unfounded or excessive in which case we may charge a reasonable fee.
You don't need to state why you wish to access the information. The details we require are merely those that will aid the efficient location and retrieval of information.
On receipt of an Access Request, we will make all efforts to fully comply with the request within 1 month. However, in the case of complex requests this time period may be extended by up to 2 further months. In the event that we deem your request to be complex, and require to extend the time period, we will write to you to let you know.
Please see our Access Request guidance (pdf 251KB) for more information.
If you are not satisfied with how we have answered your request or have concerns about how we handled your personal information, please contact our Data Protection Officer. When you contact our DPO we can consider your concerns as quickly as possible.
You also have the right to raise a concern on the Information Commissioner's Office website.