This page explains our process for responding to subject access requests under the General Data Protection Regulations.

 What is a subject access request?

A subject access request is a request for personal information held about individuals. People have the right to see what personal information we hold about them, the lawful basis for processing, a description of the information, what we use it for and who we might pass it onto.  This right is subject to certain exemptions in the General Data Protection Regulations.

What we do when we receive a subject access request

When a subject access request is received, the Chief Executive is notified immediately.  No employee, volunteer or trustee can respond to a subject access request without first informing the Chief Executive.

 It is the responsibility of the Chief Executive to determine if sufficient identification and authority of the individual has been provided in order to provide the data requested.

 If a subject access request is made by a relative, representative or third party on behalf of a person, they must supply the individual’s consent for the release of their personal data. If the third party has been appointed to act for someone under the Mental Capacity Act 2005 including Power of Attorney, they must confirm and evidence their capacity to act on the person’s behalf. If the third party is the parent or guardian of a child under 16, they must provide proof of this relationship. Any third party acting on behalf of an individual must also provide identification for themselves.

The Chief Executive will gather any manual or electronically held information.  If any of the information we hold about an individual identifies a third party, then the third party will be contacted to seek permission to disclose relevant information.  If the third party does not provide consent for disclosure, then that portion of information may not be disclosed. 

Before sharing any information that relates to third parties, the Chief Executive will, where possible, anonymise information that identifies third parties not already known to the individual and edit information that might affect another party’s privacy. Information may also be summarised as opposed to providing a copy of the whole document.

Issuing a response

The Chief Executive will provide information to the person making the request except where they agree to withdraw the request, or where it is impossible to provide the data. In these cases, an alternative may be arranged.

Under the General Data Protection Regulations no charge will be made for the data subject access request.  However, if a request is considered repetitive or excessive due to resources needed, then a fee may be levied.

Information will be provided within 28 days of receipt of the subject access request. If a request is complex, or if numerous related requests are made, the time period may be extended to three months.  If this is the case the individual requesting access will be notified of the timescales within 28 days of receipt of the access request, with an explanation as to the delay.

Errors in our records

If the individual identifies inaccurate information and the Community Foundation agrees to the inaccuracy, the information will be corrected where practicable, and the incorrect information destroyed. If the Community Foundation does not agree or feels unable to decide whether the information is inaccurate a note of the alleged error will be made and kept on file.

Complaints

If the person requesting a data disclosure is not satisfied by the actions taken by the Community Foundation, they can seek recourse through the complaints procedure, or the Information Commissioner Office.

 The Chief Executive will deal with any complaint about the way a request has been handled and about what information has been disclosed.

Make a Data Subject Access Request

To make a subject access request please use our customer portal, which can be found here

 

Other ways to contact us

Relay UK: If you are deaf or hard of hearing, or have speech difficulties, you can contact us using Relay UK.  This is a free service and you can find out more here.  Using Relay UK means you would type your question to a Relay Assistant who would speak the question to us.  They would listen to our reply and type the response back to you.  If you are already using Relay UK you can call 18001 01785 339540 to engage the service.  If you are not currently using Relay UK you can contact them to sign up.

British Sign Language: You can contact us using video services using BSL.  There are many different providers, but two examples are SignVideo, and Sign Solutions using InterpretersLive!  These are services where you can video call a BSL interpreter, speak with them using BSL and they will relay the call to us, and give our response back to you.  If you use British Sign Language please email us to arrange a BSL-interpreted call or video meeting.

Tell us how you’d like to be contacted

If you don’t want to use Relay UK or BSL calls, or don’t want to, please get in touch with us by email at office@staffordshire.foundation, telephone on 01785 339540 or by text on 07383 722064 and let us know how you’d like us to contact you.

If your enquiry relates to a data access request, a complaint, a whistleblowing issue, or reporting an incident, you can also use our online customer portal here.