Procedure for Dealing with Subject Access Requests

Recognising a Subject Access Request

A request to see a copy of the personal data held about an individual user of ART services may come to any authorised volunteer or employee of ART. ART must respond whether the request is made electronically, via social media, in writing or verbally. An individual can make a request using any form of words provided they make it clear that the enquiry concerns a wish to see their personal data.

Responding to a Request

It is anticipated that, in line with ICO good practice guidance, most Subject Access Requests can be met using secure self-service access to SmART Ringer. This is available to different classes of user within their existing access permissions. The procedure is:

  • All requests for details of the data held by ART about an individual should be passed to the ART Administrator within 7 days if the request has been made to someone other than the ART Administrator.
  • The first step will be for the Administrator to establish that the enquirer is the data subject and can be given legitimate access to the data. A check with the data subject by email will be made if necessary.
  • Nearly all of the data held by ART about individual ringers, delegate teachers and members are accessible to those individuals on a secure self-service basis through SmART Ringer.
  • A standard letter response will be sent to enquirer explaining what data is held on SmART Ringer, how they can access it for themselves and what other data is held by ART. The ART Administrator will send this within 14 days of the original request.
  • The letter will indicate that the enquirer may request a copy of the data not accessible to them through SmART Ringer. If requested, this will be provided to them in a Word document to which the data has been copied and pasted.
  • The Administrator will provide a formal response on behalf of ART within 14 days. Overall, Data Protection law requires a response to be made within one month in normal circumstances.

Keeping records of Requests

The Administrator will keep a central record of all subject access requests received:

  • The name of the enquirer
  • Their role
  • The date the request was received
  • The date a response was sent
  • Whether there was a request for further data

Procedure History

Last Modified: October 2019

Last Reviewed: October 2019

Contact

If you have any questions about this policy or data protection you are invited to contact the Association at:

dataprotection@bellringing.org