Individual Rights Requests (subject access requests)
Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) all individuals (data subjects) have a right to access or challenge the processing of their personal data being held and managed by an organisation.
In this section, you can learn more about your rights and how to exercise them.
Right to be informed
This right ensures transparency on how your data is processed. Achieving for Children is obliged to inform you in our privacy information at the point of collection or in our privacy notice of:
- why we need to process your data
- how long we intend to keep it
- who we plan to share it with.
If your data has been obtained from another organisation and we are the controller of this information, we must provide you with privacy information no later than one month from the date of collection. This is not necessary if you already have privacy information or it involves a disproportionate effort to provide it to you.
Our privacy notices are published on our website.
Right of Access (also known as Subject Access Request)
You have the right to get confirmation that we are processing your personal data and obtain a copy of it. This includes your:
- Paper records
- Electronic records
- CCTV footage
Only the following people can request to see personal information about an individual:
- The person the information is about (the ‘data subject’); this includes somebody under 18 if they understand the nature of the request
- An agent acting on behalf of the data subject, eg. a solicitor
- A person acting under an order of the Court of Protection or acting within the terms of a registered Lasting Power of Attorney in relation to somebody who lacks the capacity to manage their affairs and make the request themselves
- The parent or legal guardian of the data subject if they are under 12 or lack sufficient maturity until a later age
Under the Data Protection Act, there is some information we are entitled to withhold. Information we hold about you is exempt from disclosure and cannot be given to you if it was obtained:
- For the purpose of preventing or detecting crime
- For the purpose of apprehending or prosecuting offenders
- In connection with current or prospective legal proceedings or for the purpose of obtaining legal advice
- We may also need to get permission from other individuals to disclose their information to you
Right to rectification
You have the right to ask Achieving for Children to correct any personal information it holds about you to ensure your data is accurate. You may also ask that we complete incomplete data held about you.
Right of erasure
You have the right to ask that your personal data be erased or deleted. This is also known as the ‘right to be forgotten’.
This right is not absolute and therefore only applies in certain circumstances. You can request to have your personal data erased if:
- Your personal is no longer needed for the purpose it was collected or processed
- You withdraw your consent (where “consent” is the lawful basis for processing)
- Achieving for Children is legitimately processing your data as part of the business function but your right overrides this
- Your personal data has been processed unlawfully
- The erasure is required as a legal obligation.
It does not apply if we need the information to provide a service we are authorised to provide by law, for a legal obligation or we believe the data to be necessary for a task in the overriding public interest.
If your data has been disclosed to a third party, Achieving for Children will ask them to erase that data, unless this proves impossible or involves disproportionate effort.
Right to restriction of processing
You have the right to request that the processing of your data is restricted or suppressed, in other words, you can limit how we use your data. This is not an absolute right and therefore it only applies in certain circumstances.
You can request to restrict the processing of your data if:
- You contest the accuracy of personal data and would like this verified
- The data has been processed unlawfully
- Achieving for Children no longer needs your personal data for processing, but you need us to keep it for a particular purpose such as a legal claim.
Achieving for Children will investigate your request and where no grounds for restriction are found, notify you that the restriction will be lifted and advise you of your rights to request an internal review or make a complaint.
Right to portability
This right allows you to obtain and reuse your personal data for your own purpose across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without affecting its usability. This right only applies to the information you have provided and where it is held electronically.
You can make a data portability request when Achieving for Children is processing your information:
- By automated means and relies on your consent to use your personal data, or
- Uses your data as part of a contract you have with us.
Right to object
You have the right to object to Achieving for Children processing your personal information. This is not an absolute right and only applies in certain limited circumstances.
You have the right to object to the processing of your personal information where Achieving for Children is relying upon one of the following reasons as a lawful basis for processing your personal information.
- Public task
- Legitimate interests
How to request access to your information or exercise any of your other individual rights?
You can make your request verbally or in writing. We do, however, recommend that verbal requests are followed in writing as this will help us identify what you need and enable us to obtain this more quickly and accurately.
If you are requesting information about yourself, or about your child, you will need to provide copies of:
- Photo ID, eg a passport or driver’s licence
- Proof of address (if this is not included in your photo ID), eg. a Council Tax registration form, Council or Housing Trust rent book, medical card or utilities bill
- Proof of parental responsibility, if applicable
- If you are requesting information about your child and they are aged 12 or over and capable of understanding the request, you will also need to upload a signed letter from them giving consent for you to act on their behalf.
If you are an agent acting on behalf of the data subject, you will need to provide:
- A letter of consent signed by the data subject
If you are requesting information on behalf of an adult who lacks the capacity to make their own request, you will need to upload:
- Proof that you have the legal right to make the request
Please send your request and copy of your ID documentation to:
Email: firstname.lastname@example.org (please be aware that this is not a secure mailbox, so if you use this email address you should be aware that you are sending data unencrypted)
or post it to:
Information Governance Team
Achieving for Children
42 York Street
Twickenham TW1 3BW
What happens next?
Achieving for Children has one calendar month to respond, from the date we receive your ID.
The clock is paused if any part of your request needs to be clarified.
If your request is complex, we can extend the processing time by a further two months from the date of receipt.
Who to contact if you need further information, advice or to make a complaint about your request
If you have any further queries, a complaint or want to request an internal review, please contact the Information Governance Team at email@example.com and we will respond to your request.
If you are unhappy with how we handled your request, your internal review or how we are processing your data, you can complain to the Information Commissioner’s Office (ICO). https://ico.org.uk/make-a-complaint/