Make a Subject Access Request (SAR)

Under the General Data Protection Regulation (GDPR), an individual has the right to request all personal data that an organisation holds about them by making a subject access request.

You can make a request to access your personal information by email or by post.

Email us at sar@sutton.gov.uk, or post your request to us at

Customer Care and Improvement Team
London Borough of Sutton
Civic Offices
St Nicholas Way, Sutton
SM1 1EA

The information you need to provide

A clear, specific request

The Council does not have to start working on a Subject Access Request until you have provided enough information for us to find the personal data.

For example, a request for 'all of the personal data held on me' is not specific enough for us to find your personal data.

The Council processes personal information for many reasons. The most requested information types are:

• social care information
• housing benefit files
• council tax information
• employment files

You will need to state which Council departments you have dealt with.

If you are requesting social care information, provide details of any family members who were also involved with social care. This will allow us to conduct a more thorough search of our social care records and allow us to provide you with more information.

Current identification

The Council takes great care to ensure that personal data is only disclosed to those who are authorised to access it. For this reason you will need to provide a form of ID from each of the lists below in order to request your personal information.

Acceptable name identification:

• driver's licence
• passport
• birth certificate

Acceptable proof of address:

• utility bill
• bank statement
• council tax bill

Address ID is necessary in order to ensure that your personal data is being posted to the right place. If you would rather pick up your data by hand then please let us know.

Identification can be included within your postal application, or a clear scanned/photographed copy can be emailed to us at sar@sutton.gov.uk.

How long a Subject Access Request takes

The General Data Protection Regulation gives data controllers one month to complete a Subject Access Request. This time starts from when the Council receives a clear request and enough identification to be sure that the request is from the data subject.

Some social care files are very large and may take longer than a month to complete. If this is the case with your request, we will contact you.

Children's information

Information about children may be released to a person with parental responsibility. However, the best interests of the child will always be considered.

Even if a child is very young, data about them is still their personal data and does not belong to anyone else. It is the child who has a right of access to the information held about them.

Before responding to a request for information held about a child, we will consider whether the child is mature enough to understand their rights. In normal circumstances, we consider a child of 12 or older is old enough to understand their rights.

For children under the age of 12, we will consider applications from whoever has parental responsibility for the child. We will take into account details of the specific case.

What happens if some or all of your request is refused

The Council is permitted to withhold information if it falls under one of the exemptions in the Act.

If you are unhappy with the decision, you can write to the Information Commissioner to request a review of that decision.

Reviewing a request

The first stage is to contact us to request a review of your request. The General Data Protection Regulation does not specify how long a review should take but in most cases the Council will attempt to review your request within 20 working days.

If you are still unsatisfied after a review then the next stage is to contact the Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 113

Email: icocasework@ico.org.uk