Get College Subject Access Request Form 2021-2025

You have the right to ask an organisation if they're using or storing your personal information. You can also ask them for copies of your personal information. This is called the right of access and is also known as making a subject access request, a SAR or a DSAR.

Norfolk County Council collects and uses certain types of information about people we work with. The General Data Protection Regulation sets out that all personal information must be dealt with properly however it is collected, recorded and used - whether on paper, in a computer, or on other material.

You must comply with a SAR without undue delay and at the latest within one month of receiving the request. You can extend the time to respond by a further two months if the request is complex or you have received a number of requests from the individual, eg other types of requests relating to individuals' rights.

What are the time limits? If you exercise any of your rights under data protection law, the organisation you're dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request.

How long does a controller have to respond to an access request? Controllers who receive a valid subject access request must respond to the request without undue delay and at the latest within one month of receiving the request.

Organisations have one calendar month to respond to a SAR , starting from the day a SAR is submitted. If you receive a request on the last day of the month and the following month is shorter, a response must be made by the last day of the shorter month.