Subject Access Request (SAR) Policy Billing Parish Council

Purpose of this Policy

This policy explains how individuals can exercise their **right of access** to personal data held by Billing Parish Council. It sets out how requests will be received, verified, processed, and responded to in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What is a Subject Access Request?

A Subject Access Request (SAR) is a request made by an individual to obtain:

  • Confirmation that the council is processing their personal data
  • Access to that personal data
  • Other supplementary information required under Article 15 UK GDPR

Personal data is defined as any information relating to an identifiable living individual. This aligns with the definition already provided in the council’s Privacy Policy [billing-pc.gov.uk](https://www.billing-pc.gov.uk/privacy-policy).

How to Make a Subject Access Request

A SAR can be submitted in any of the following ways:

  • By email:clerk@billing-pc.gov.uk
  • By post: Bernard Weston Pavilion, Off Penfold Lane, Great Billing Northampton, NN3 9EF
  • In person: By contacting the Clerk to arrange an appointment

Requests do **not** need to mention “Subject Access Request” specifically, but they must clearly indicate that the individual is asking for their own personal data.

To help us process the request efficiently, individuals are encouraged to include:

  • Full name and contact details
  • Details of the information sought
  • Any relevant dates, departments, or interactions
  • Preferred format for receiving the response

Identity Verification

Before releasing any personal data, the council must verify the requester’s identity to protect against unauthorised disclosure.

We may ask for:

  • A copy of a passport, driving licence, or other official ID
  • Proof of address (e.g., utility bill)

The one‑month response period does not begin until identity has been verified.

Timescales for Responding

Billing Parish Council will respond to SARs **within one month** of receipt, as stated in the Privacy Policy’s rights section [billing-pc.gov.uk](https://www.billing-pc.gov.uk/privacy-policy).

An extension of up to **two additional months** may be applied if the request is complex or numerous. If an extension is required, the requester will be informed within the initial one‑month period.

Scope of Searches

The council will conduct reasonable and proportionate searches across all systems and records where personal data may be held, including:

  • Email accounts
  • Electronic files
  • Paper records
  • Council databases
  • Records held by contractors acting on behalf of the council

Third‑Party Data and Redaction

The council must protect the rights of other individuals. Personal data relating to third parties will be redacted unless:

  • The third party has consented, or
  • It is reasonable to disclose the information without consent

Exemptions

Certain information may be withheld where UK GDPR or the Data Protection Act 2018 provides an exemption. Examples include:

  • Legal professional privilege
  • Management forecasting
  • Crime and taxation exemptions
  • Confidential references

Where an exemption applies, the council will explain the reason unless doing so would itself breach an exemption.

Fees

SARs are normally free of charge.
A reasonable fee may be charged only if:

  • The request is manifestly unfounded or excessive, or
  • Additional copies of the same data are requested

This is consistent with the council’s existing Privacy Policy wording on fees for repeated requests [billing-pc.gov.uk](https://www.billing-pc.gov.uk/privacy-policy).

How Data Will Be Provided

Responses will be provided:

  • In writing, electronically, or verbally (if requested)
  • In a concise, transparent, and easily accessible format
  • Securely, using appropriate technical measures

Complaints

If an individual is dissatisfied with how their request has been handled, they may contact:

  • The Clerk, Billing Parish Council
  • The Information Commissioner’s Office (ICO), as referenced in the Privacy Policy [billing-pc.gov.uk](https://www.billing-pc.gov.uk/privacy-policy)

Review of this Policy

This policy will be reviewed annually or sooner if required by changes in legislation or council procedures.