Right of access (RoA) / data subject access requests (DSAR) policy and procedure

Time limits

The requested information must be provided without delay and at the latest within one calendar month of receipt.

This can be extended by a further two months where the request is complex or where there are numerous requests. If an extension is required, the applicant must be notified with an explanation of why it is necessary.

All refusals must be in writing setting out the reasons and the rights of the data subject. The applicant must be notified within one calendar month of receipt of the request and must be made aware that they can contact the DPO if they believe that the process has not been lawful or compliant to legislation, or the Information Commissioner’s Office.