Subject Access Request Response

To: [Requester name]

From: [Business name] ([contact])

We received your request on [date].

[what was requested].

We enclose the personal data we hold about you, subject to any applicable exemptions, along with information about how and why we process it.

If any data has been withheld under an exemption, we explain why.

We aim to respond to a subject access request within one month of receiving it (and of confirming your identity). If your request is complex or you have made a number of requests, we may extend this by up to a further two months, in which case we will let you know within the first month and explain why. To confirm your identity, we may need to ask you for [details of the identification you require].

Along with a copy of your data we are providing the supplementary information you are entitled to: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipient we disclose it to; the retention period or the criteria used to set it; the existence of your rights to rectification, erasure, restriction and objection; your right to complain to the ICO; and, where the data was not obtained from you, its source.

You can ask us to correct or erase data, and you can complain to the ICO if you are unhappy with our response.

You also have the right to ask us to restrict or object to our processing, and to data portability where it applies. If we rely on your consent for any processing, you can withdraw it at any time.

If you are unhappy with how we have handled your request, please contact us so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.