How to make a Subject Access Request (Request for personal data under the Data protection law) request?

Under Data Protection Law, you have the right to make a Subject Access Request in writing so that you can access information from any CIG department that processes your personal data (you being the 'subject' of the information).

You have the right to get a copy of the information that is held about you by making a Subject Access Request.

 

Who to make your request to    

To make an access request under the Data Protection Act 2018, you should contact us at the details below. foi.csd@gov.ky 

 

What to include in your request  

Please tell us exactly what information you want to access in writing. To help you and to guide us, please complete and send us our subject access request (SAR) application form at foi.csd@gov.ky 

Proof of identity    

You may be asked to submit a copy of:

• photographic identification, such as a passport or driver’s licence
• a recent utility bill or official letter

This is because we must be sure of your identity before releasing any personal information to you.
You can email or post copies of your proof of identity to us. We’ll only be able to start processing your request once we receive this information.

 

How long it takes to answer a request    

We’ll respond to your data access request within 30 days. We’ll usually send you our response by email or by post.
Extension of up to 30 days may be applied (which can be extended for a good cause)

 

Exceptions to your right of access    

In some cases, the data protection acts limit your right to access your personal information. For example, if the information:

• is kept for the purpose of preventing, detecting or investigating criminal offences, where allowing access would be likely to interfere with these activities
• would be subject to legal professional privilege in court
• consists of an opinion about you given in confidence by another person (subject to certain conditions)

 

Information about other people  

The department does not have to accept your access request if it would result in disclosing data about another person. That other person must consent to the disclosure first. So if we have a record that contains your personal data and another person’s data, this will limit what data we can give you. We’ll give you as much of the information as we can, without identifying the other person.

 

Our data protection notice    

(coming soon). 

 

Ombudsman (Data protection)    

You can find more information on your rights on the Ombudsman website: https://ombudsman.ky/data-protection
The website also explains how to submit a complaint to the Ombudsman, if you’re not satisfied with our response to your request.