Subject access requests

Anyone has the right to make a Subject Access Request (SAR) of any organisation that may be processing their personal data. This is a right set out in Data Protection legislation and you can read more about this right on the Information Commissioner’s website.

Essentially, you have the right to ask an organisation whether or not they are using or storing your personal information and to receive a copy of that information and a summary of how it is being used. This is called the right of access and is commonly known as making a subject access request or SAR.

You can make a request for your own data, or authorise someone to make the request on your behalf, but you will be asked to confirm any authorisation. Children can make their own request if they are competent to do so, or a parent/guardian can make a request on their behalf.

You can submit a SAR in writing, or verbally. When making your request it is helpful to provide as much context as possible, so we know where to look for your data, for example, the particular research you were involved in, or your period of employment at ICNARC.

You can ask about particular personal data, or you can ask about everything we may hold about you.

When submitting your request, you can provide some information that will help us to identify you, such as your name at the time or your address, but please do not include any highly sensitive paperwork to prove your identity at this stage.

You can make a request at any time, and you do not have to pay a fee.

Please contact ICNARC to make your request.

  • The quickest way to make a request is to email the Data Protection Officer at DPO@icnarc.org
  • You can write to the DPO if you prefer: DPO, ICNARC, Napier House, 24 High Holborn, London WC1V 6AZ
  • Or you can call to make your request, 020 4513 6235

We have one calendar month to send a response to you. If we require further information or clarification about your request we will contact you.

We have to be sure of your identity before responding to the request so we may ask you to verify your identity by providing some further information.

We will gather and review all the personal information we hold about you and, if no exemptions apply to your information, we will provide a copy and tell you:

  • what we are/have been using your information for
  • who we are/have been sharing your information with
  • how long we will store your information, and how we determined this
  • details on your rights to challenge the accuracy of your information, to have it deleted, or to object to its use
  • your right to complain to the ICO
  • details about where we got your information from
  • whether we use your information for profiling or automated decision-making and how we are doing this
  • what security measures we took if we have transferred your information to a third country or an international organisation

Some exemptions apply to SARs and if this is the case we will inform you of the exemption we are applying to you request and explain our decision.

If, for any reason, you are not happy with our response to your SAR, or disagree with the exemption applied, you can complain to the Information Commissioner who will ask us to explain how and why we responded to your request. You can contact them by email, phone, letter or live chat on their website.