Subject Access Procedure

Scope

All personal data processed by Trust Mediation is within the scope of this procedure.

Data subjects are entitled to obtain:

Confirmation as to whether Trust Mediation is processing any personal data about that individual;
Access to their personal data;
Any related information

Responsibilities

The Data Protection Officer is responsible for the application and effective working of this procedure, and for reporting to the Board of Directors on Subject Access Requests (SARs).

The Data Protection Officer is responsible for handling all SARs.

Procedure

Subject Access Requests are made using the Subject Access Request Form.

The data subject provides Trust Mediation with evidence of their identity, in the form of two forms of identification (Passport, Driving licence, Birth certificate, Utility bill (from last 3 months), Current vehicle registration document, Bank statement (from last 3 months), Rent book (from last 3 months)), and the signature on the identity must be cross-checked to that on the application form.

The data subject specifies to Trust Mediation specific set of data held by Trust Mediation on their subject access request (SAR). The data subject can request all data held on them.

Trust Mediation records the date that the identification checks were conducted and the specification of the data sought.

Trust Mediation provides the requested information to the data subject within one month from this recorded date. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

Trust Mediation shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

Once received, the DPO/ IG Lead collects the data requested within the specified time frame.

The DPO/ IG Lead maintains a record of requests for data and of its receipt, including dates.

The DPO/ IG Lead reviews subject access requests from a child: Before responding to a SAR of the child data subject the DPO/ IG Lead whether the child is mature enough to understand their rights.

The DPO/ IG Lead reviews all documents that have been provided to identify whether any third parties are present in it, and either removes the identifying third party information from the documentation or obtains written consent from the third party for their identity to be revealed.

If any of the requested data is being held or processed under one of the following exemptions, it does not have to be provided:

· National security

· Crime and taxation

· Health

· Education

· Social Work

· Regulatory activity

· Journalism, literature and art

· Research history, and statistics

· Publicly available information

· Corporate finance

· Examination marks

· Examinations scripts

· Domestic processing

· Confidential references

· Judicial appointments, honours and dignities

· Crown of ministerial appointments

· Management forecasts

· Negotiations

· Legal advice and proceedings

· Self-incrimination

· Human fertilization and embryology

· Adoption records

· Special educational needs

· Parental records and reports

If a data subject requests Trust Mediation to provide them with the personal data stored then Trust Mediation will provide the data subject with the requested information in electronic format, unless otherwise specified.

Trust Mediation keeps a record of what data was provided in response to SARs and the date a response was sent to the data subjects or their representative.

Trust Mediation uses the PDF electronic formats to respond to SARs.