Data Protection

The Data Protection Act gives people the right to know what personal information an organisation has about them. To use this right, you can make what is known as a ‘subject access request’

Only the following people may apply for access to personal information:

  • The person who the information is about.
  • Someone acting on behalf of the person who the information is about.

Making false or misleading statements to access personal information which you are not entitled to is a criminal offence.
If you wish to know what personal information we hold about you, you can apply for access using our data protection subject access request form.

Subject Access Application Form

You have a right to know the following:

  • What kind of information we keep about you.
  • The reason we are keeping it and how we use it.
  • Who gave us your information.
  • Who we might share your information with and who might see your information.
  • How long your information will be stored for, or the criteria used to determine that period.
  • If your information is used in automated decision making or profiling, and, if so, about the logic involved and likely consequences for you.
  • What safeguards are in place to protect any information we transfer to third countries or international organisations.

You also have the right to have any codes or jargon in the information explained.

We publish a Data Protection Notice  which gives information about how we use personal data and your rights.

Data protection law also gives individuals a number of rights, including to:

  • request rectification of inaccurate or incomplete personal data
  • in some circumstances - request erasure of their personal data
  • in some circumstances - request restriction of processing of their personal data
  • in some circumstances - object to processing of their personal data
  • lodge a complaint with the Information Commissioner’s Office