Adopted: 21 September 2026  |  Review Date: September 2028

This subject access request policy sets out the procedures we have put in place to facilitate responding to subject access requests within our organisation.

We are Perranzabuloe Parish Council a council in England.  Our contact details are Perranzabuloe Parish Council, Chyanhale, Ponsmere Valley, Perranporth, TR6 0DB, email: clerk@perranzabuloe-pc.gov.uk

We are a data controller for personal data as defined by all applicable data protection and privacy laws including, but not limited to, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation (the “Data Protection Legislation”).

This policy is binding on all employees, members and volunteers (“User” or “Users”) of Perranzabuloe Parish Council (“The Organisation”) in order to protect Personal or other Data (“Personal Data” or “Data”) processed by the organisation.

It applies to all organised filing systems be they computer based, paper based or any other such method of organising information which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis (“Filing Systems”).

  1. Definition of personal data
  • “Personal data” means any information relating to an identified or identifiable individual (“data subject”); an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
  • Personal data will typically contain information about the individual or their activities.

    2. Who is responsible for managing subject access requests
  • The Parish Clerk is responsible for the ongoing compliance monitoring of this and other policies that are designed to achieve compliance with the Data Protection Legislation. (“the person responsible for data protection”).
  • No user within the organisation shall deviate from this policy without written authorisation from the person responsible for data protection.3. Subject access request
  • Individuals have the right to access and receive a copy of their personal data, and other supplementary information.
  • Subject Access Request (“SAR”) is a legal mechanism that has a very strictly defined and specific ambit.
  • It is a right that entitles a data subject to be informed by the organisation as to whether and how the organisation processes their personal data, a copy of that data and other supplementary information.
  • The parameters of the right are set out clearly in the UK GDPR which provides that a data subject “shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data”.
  • Subject access request is not a right to request ‘documents’ and is different to the freedom of information laws.
  • The organisation believes that the right of access is key to allowing individuals to have real control over their own personal data, however there are times when the right of access can be refused wholly or partially.
  • A subject access request can be refused if it is:
    • Manifestly unfounded. A request may be manifestly unfounded if:
    • The individual clearly has no intention to exercise their right of access. For example an individual makes a request, but then offers to withdraw it in return for some form of benefit from the organisation, or
      • The request is malicious in intent and is being used to harass the organisation with no real purposes other than to cause disruption.
    • A request may be excessive if:
      • It repeats the substance of previous requests; or
      • It overlaps with other requests.
    • The person responsible for data protection shall decide if a request is manifestly unfounded or excessive on a case-by-case basis. The organisation does not have a blanket policy on refusal.
    • All requests should be considered in the context in which it is made.
    • If a request is refused the person responsible for data protection should document why they consider the request is manifestly unfounded or excessive.
    • In the event of refusal of a subject access request the person responsible for data protection will inform the individual without undue delay and within 28 days of receipt of the request and provide:
      • The reasons the organisation is not taking action;
      • Their right to make a complaint to the ICO and,
      • Their ability to seek to enforce this right through a judicial remedy.
    • There are other exemptions that the person responsible for data protection must consider when preparing to disclose personal data to a SAR requestor.
    • If the response to the request would disclose personal data of another individual the person responsible for data protection shall make sure that the information has been redacted with a suitable redaction tool or method to maintain the confidentiality of the third party individual(s).
    • Schedules 2 and 3 of the UK Data Protection Act 2018 provide various other exemptions from subject access requests, the person responsible for data protection shall take professional advice on correct application of these exemptions if they are to be relied upon.
      • Crime and taxation: general.
      • Crime and taxation: risk assessment.
      • Legal professional privilege.
      • Functions designed to protect the public.
      • Regulatory functions relating to legal services, the health service and children’s services.
      • Other regulatory functions.
      • Judicial appointments, independence and proceedings.
      • Journalism, academia, art and literature.
      • Research and statistics.
      • Archiving in the public interest.
      • Health, education and social work data.
      • Child abuse data.
      • Management information.
      • Negotiations with the requester.
      • Confidential references.
      • Exam scripts and exam marks.
      • Other Exemptions.

The full policy is available to view and download.