Subject Access Request (SAR) Procedure

This procedure explains how a candidate, worker, client contact, or other individual can request a copy of the personal data RD1 holds about them (a Subject Access Request, or SAR), and how RD1 responds, in line with Article 15 of the UK GDPR and the Data Protection Act 2018.

A SAR can be made in any form — by email to accounts@rd1.co.uk, in writing, or verbally to any member of RD1 staff — and does not need to mention "Subject Access Request" by name to be valid; any clear request for a copy of one's own personal data is treated as a SAR.

RD1 will ask for reasonable proof of identity before releasing personal data, to ensure data is not disclosed to the wrong person. This is proportionate to the sensitivity of the data being requested and will not be used to create unnecessary delay.

On a valid request, RD1 provides confirmation of whether we process the individual's personal data, a copy of that data, and supplementary information including the purposes of processing, the categories of data held, who it has been or will be shared with, how long it is kept, and the individual's other rights (including to rectification, erasure, and to complain to the ICO).

RD1 responds within one calendar month of receiving the request (and confirming identity, where verification is needed). This can be extended by a further two months for requests that are complex or numerous, in which case RD1 will explain the reason for the extension within the first month.

Some information may be withheld or redacted where an exemption applies — for example where it would reveal another individual's personal data without their consent, or where it is protected by legal privilege. Where information is withheld, RD1 explains the general reason unless doing so would itself undermine the exemption.

RD1 does not charge a fee for a SAR, unless the request is manifestly unfounded or excessive (for example, repetitive requests), in which case RD1 may charge a reasonable administrative fee or refuse the request, explaining why.

Where RD1 cannot comply with a request, in whole or in part, we explain why, and inform the individual of their right to complain to the ICO or to seek a judicial remedy.

The Directors are responsible for handling SARs and ensuring they are logged, verified, and responded to within the statutory timescale.