Subject Access Requests (SAR)
As of 25/05/2018, individuals will have the right to obtain:
- confirmation that their data is being processed;
- access to their personal data; and
- other supplementary information – this largely corresponds to the information that should be provided in a privacy notice (see Article 15).
The purpose of the right of access under GDPR is so that you are aware of and can verify the lawfulness of the processing (Recital 63).
No charge is made for copy of the information save where we will require a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive or to comply with requests for further copies of the same information. The fee will be based on the administrative cost of providing the information.
Information will be provided within one month of receipt save where requests are complex or numerous when we may extend the period of compliance by a further two months. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
Where a request is manifestly unfounded, excessive or repetitive we may charge a fee, we may refuse to respond. If we refuse to respond to a request, we will explain why. You will have the right to complain to the supervisory authority and to a judicial remedy without undue delay and at the latest within one month.
To progress a request, we will need to verify the identity of the person making the request, using reasonable means. In the absence of being able to charge a fee, even a refundable one, use of a cheque is no longer an option. The types of information we require are one from the following two lists.
Proof of Identity & Name
- Valid full UK passport or
- Valid full UK photocard driving licence
Proof of Residence
- Valid full UK driving licence (inc. old style paper) or
- Valid provisional UK photocard driving licence or
- UK-based bank or building society statement (must be less than 3 months old) or
- UK-based bank or building society credit card statement (must be less than 3 months old) or
- UK mortgage statement (must be less than 12 months old) or
- UK gas or electricity bill (must be less than 3 months old) or
- UK phone bill (not mobile; must be less than 3 months old) or
- UK water bill (must be less than 12 months old) or
- UK council tax bill (must be less than 12 months old) or
- UK Credit Union statement (must be less than 3 months old) or
- Letter from Benefits Agency, including Universal Credit welcome letters (must be less than 12 months old) or
- Benefit letter from your local housing authority (must be less than 12 months old) or
- Tenancy agreement from a housing association or a council or
- Letter from a university or college (must be less than 12 months old)
It is possible to make requests electronically (e.g. by email) to do so. Where a request is made electronically, the information can be provided in a commonly-used electronic form (PDF – portable document format), unless you request otherwise. CMA will not be responsible for any loss of personal data in transmitting your data to us. Use of electronic submission is at your risk.
A form for your ease of request can be obtained by clicking here.