Introduction
Kind Communities is committed to making information accessible in accordance with data protection law.
The purpose of this policy is to explain a data subject’s rights to access personal information that Kind Communities holds about them and to explain how Kind Communities deals with subject access requests.
The policy is supported by the guidance issued by the Information Commissioner’s Office and relevant Government departments from time to time.
Subject Access Requests
Under the General Data Protection Regulation (GDPR), data subjects have a statutory right to have access to personal data Kind Communities holds about them unless an exemption applies.
For the purposes of the GDPR, “personal data” is information that relates to a living identifiable person. The person or organisation who controls the purpose and manner in which data is processed is the “data controller”.
Where Kind Communities is the data controller, data subjects are entitled to be told whether data is held about them, and if it does:
- To be given a description of the data in question;
- To be given a copy of the data;
- To be given other supplementary information, e.g. to be told for what purposes the data is processed;
- To be told the recipients, or classes of recipients, to whom the data is or may be disclosed;
- To be told the retention period.
Data subjects are also entitled to a copy of the information with any unintelligible terms, acronyms or codes explained. Individuals will also be given any information available to Kind Communities on the source of the data. The data will be in its latest form.
A request for access to personal data will be dealt within one month from the day of receipt of the request unless Kind Communities is unable to do so due to the scale or complexity of the request.
Under GDPR, data subjects have a number of other rights. These include:
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
Any requests requested that fall into the above categories will be considered as a Subject Access Request and handled in accordance with this policy.
Please read our General Privacy Notice: https://kind-communities.org/website-privacy-policy/
More information on the GDPR and the Data Protection Act can be found on the ICO’s website: https://ico.org.uk/
How to make a subject access request.
If data subjects wish to apply for access to their personal data or any of their other rights under GDPR, they should email GDPR@kind-communities.org
Kind Communities will make reasonable adjustments to how it deals with requests in accordance with the Equality Act 2010. For example if a requester has a disability we will consider reasonable adjustments such as Braille, large print, email or audio formats.
Kind Communities will request certain information from an individual to verify their identity before responding to a subject access request. The timeframe for responding to the subject access request will not begin until verification has been completed.
Fees and other matters
As a general rule Kind Communities cannot charge for supplying any information requested in a subject access request application. Kind Communities may charge a reasonable fee for:
- any further copies of the information that are requested by the data subject;
- any additional costs resulting from the data subject’s requirements;
- a request which is considered to be ‘excessive’ for the purposes of the GDPR.
Kind Communities is responsible for ensuring information is sent to a requester securely, for example where information is sent by post it may be necessary to send it by special delivery.
Complaints
If a person making a subject access request is dissatisfied with the response they have received, they should contact the Data Protection Officer at Kind Communities and see if they can resolve their concerns.
If the person remains dissatisfied following that review they are entitled to complain to the Information Commissioner’s Office (see section 6 below).
If the individual’s complaint is complex and extends beyond how their subject access request was dealt with (for example includes complaints about the services they have received), then it may be appropriate for it to be dealt with under the Kind Communities Complaints Procedure.
Complaining to the Information Commissioner’s Office
If once a complaint regarding a request for information has been considered by Kind Communities and the requestor is not satisfied with the outcome, then they are
entitled to complain to the regulator, the Information Commissioner’s Office. The website is:
https://ico.org.uk/
Training and Information for Employees
Training and information will be made available to employees of Kind Communities.
Employees should be able to recognise a subject access request, know what to do if they receive a request and understand they may be asked to assist with a request if it relates to their area.
Employees should pass any requests to the Data Protection Officer as soon as possible.
Performance and Management Reporting
Kind Communities is obliged to respond to requests for information within one month. The time frame is calculated from the day the request is received (whether it is a working day or not). If any additional information is needed to confirm the identity of the requester the period for responding begins when the additional information is received and the requester will be advised as such.
Kind Communities may extend the time limit by two further months where necessary taking into account the complexity and scale of the request. Kind Communities will inform the requester before the expiry of the first month that the time period is to be extended and give reasons for the delay.
Data is collected by Kind Communities on the number of subject access requests, any fees collected and our performance in responding to those requests within timescales.
Where exceptions and exemptions apply, this information will be recorded in order to build a knowledge base to help with future enquiries.