Sable International
Subject Access Request

1. Introduction

This procedure document supplements the subject access request (SAR) provisions set out in Sable International (hereinafter referred to as “the Company”, “we”, “us” or “our”) Data Protection Policy & Procedures and provide the process for individuals to use when making an access request, along with the protocols followed by the Company when such a request is received.

The Company needs to collect personal information to carry out our everyday business functions and services effectively and compliantly and, in some circumstances, to comply with the requirements of the law and/or regulations.

As the Company processes personal information regarding individuals (data subjects), we are obligated under the UK GDPR and the Data Protection Act 2018 to protect such information and to obtain, use, process, store and securely dispose of it only in accordance with applicable data protection laws and their principles.

1.1. The United Kingdom General Data Protection Regulation

The United Kingdom General Data Protection Regulation (UK GDPR) gives individuals the right to know what information is held about them, to access this information and to exercise other rights, including the rectification of inaccurate data. The UK GDPR is a standardised regulatory framework which ensures that personal information is obtained, handled and disposed of properly.

As the Company is obligated under the UK GDPR, we abide by the Regulations’ principles, which ensure that personal information shall be: -

• processed lawfully, fairly and in a transparent manner in relation to the data subject(‘lawfulness, fairness and transparency’)
• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes(‘purpose limitation’)
• adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)
• accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased, or rectified without delay (‘accuracy’)
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’)
• processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

The UK GDPR also requires that ‘the controller shall be responsible for, and be able to demonstrate, compliance with the UK GDPR principles’ (‘accountability’). The Company has appropriate measures, controls and procedures in place to protect and secure personal information and help ensure that it is only obtained, processed and disclosed in accordance with applicable data protection laws. We will also keep a clear record of SAR decisions, searches undertaken, any exemptions considered and the reasons for any information being withheld.

2. What is Personal Information?

Information protected under the UK GDPR is known as “personal data” and is defined as: -

“Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Further information on what constitutes personal information and your rights under the data protection Regulations can be found on the Information Commissioners Office (ICO) (hereinafter referred to as the Commissioner) website.

3. The Right of Access

Under Article 15 of the UK GDPR, an individual has the right to obtain confirmation from the controller as to whether personal data concerning them is being processed and, where it is, to access that personal data. We are committed to upholding the rights of individuals and have dedicated processes in place for responding to SARs. Where required, we will provide the personal data and the following supplementary information:

• the purposes of the processing
• the categories of personal data concerned
• the recipient(s) or categories of recipient(s) to whom the personal data have been or will be disclosed
• If the data has been transferred to a third country or international organisation(s) (and if applicable, the appropriate safeguards used)
• the envisaged period for which the personal data will be stored (or the criteria used to determine that period)
• where the personal data was not collected directly from the individual, any available information as to its source
• the existence of the right to request rectification, erasure or restriction of processing, or to object to processing
• the right to lodge a complaint with the Information Commissioner’s Office
• where applicable, the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing

3.1. How to make a Subject Access Request (SAR)?

A Subject Access Request (SAR) is a request for access to the personal information that the Company holds about you, which we are required to provide under the UK GDPR, unless an exemption applies. A SAR can be made verbally or in writing, including by email, letter, online form or through another communication channel. A request does not need to mention the UK GDPR or use the phrase “subject access request” to be valid. The information that we provide is covered in section 3 of this document.

You can make a SAR using the details provided in section 7. If a SAR is received by any member of staff, or through any business area, it must be forwarded to the Data Protection Officer as soon as possible so that the request can be logged and managed within the required timeframe. Where a request is received electronically, we will usually provide the response in a commonly used electronic format unless you ask us to provide it in another reasonable format.

3.2. What we do when we receive an Access Request

Identity verification

Subject Access Requests are passed to the Data Protection Officer as soon as they are received and a record of the request is made. The Data Protection Officer, or an authorised member of the data protection team, will take reasonable steps to confirm the identity of the individual making the request. We will only ask for additional identity information where we have reasonable doubts about the individual’s identity or where further checks are needed to protect personal information.

Where we need further information to verify your identity, we will let you know as soon as possible and explain what information is required. The response period will run from the date we receive the requested identity information. We will record the date identity information was requested and the date it was received.

If a third party, relative or representative is requesting the information on your behalf, we will verify that they have authority to act for you before taking action. This may include asking for written authority, proof of appointment, or other suitable evidence. Where identity or authority information is required, the response period will run from the date we receive the requested information.

Information gathering

If you have provided enough information in your SAR to allow us to identify the personal data requested, we will carry out reasonable and proportionate searches for personal data relating to you and ensure that the information is provided in an appropriate format. If the request is broad, unclear or we need further information to locate the relevant records, we may ask you to clarify the scope of the request. Where clarification is reasonably needed, the response period may pause until we receive the information required to continue processing the request.

Information provision

Once we have completed our searches and reviewed the information, we will provide the personal data and supplementary information in writing or, where appropriate, in a commonly used electronic form. The information will be provided in a concise, transparent, intelligible and easily accessible format, using clear and plain language. We may redact or withhold information where an exemption applies, where disclosure would adversely affect the rights and freedoms of another person, or where we are otherwise required or permitted to do so by law.

4. Fees and timeframes

We aim to complete all access requests without undue delay and within one calendar month of receiving the request. This means the deadline is calculated from the day we receive the valid request to the corresponding calendar date in the following month. Where the request is made electronically, we will usually provide the information in a commonly used electronic format unless an alternative reasonable format is requested.

Whilst we provide the information requested without a fee, further copies requested by an individual may incur a charge to cover our administrative costs.

The Company always aims to provide the requested information at the earliest opportunity and, in any event, within one calendar month. Where we reasonably require further information to verify identity, confirm authority, clarify the scope of the request or process any permitted fee, the timeframe will run from the date that information or fee is received, or may pause while we wait for clarification. Where a request is complex, or we have received a number of requests from the same individual, the response period may be extended by up to two further months. If an extension is required, we will write to you within one calendar month of receiving the request to explain the reason for the delay.

5. Your other rights

Under the UK GDPR, you have the right to request rectification of any inaccurate data held by us. Where we are notified of inaccurate data, and agree that the data is incorrect, we will amend the details immediately as directed by you and make a note on the system (or record) of the change and reason(s).

We will rectify any agreed errors without undue delay and within one month. Where applicable, we will inform you in writing of the correction and provide details of any third party to whom the inaccurate data has been disclosed, unless this proves impossible or involves disproportionate effort.

If for any reason we are unable to act in response to a request for rectification and/or data completion, we will always provide a written explanation to you and inform you of your right to complain to the Commissioner and to seek a judicial remedy.

In certain circumstances, you may also have the right to request from the Company, the erasure of personal data or to restrict the processing of personal data where it concerns your personal information, as well as the right to object to such processing. You can use the contact details in section 7 to make such requests.

6. Exemptions and refusals

The UK GDPR and the Data Protection Act 2018 contain certain exemptions and restrictions that may apply to the provision of personal information. Any exemption will be considered on a case-by-case basis and the reasons for applying it will be documented. Where a request is manifestly unfounded or excessive, or where repeated copies are requested, the Company may refuse to act on the request or charge a reasonable fee, where permitted by law.

Where we do not act on a request, or where information is withheld, we will explain the reason where we are able to do so. We will also inform you of your right to raise the matter with Sable International, your right to lodge a complaint with the Information Commissioner’s Office and your right to seek a judicial remedy. Details of how to contact the Commissioner are set out in section 7 of this document.

7. Submission and lodging a complaint

To submit your SAR, you can contact us at [email protected]. You can also submit your request in writing by sending it by post to:

FAO Leanne Shrosbree
Sable International
5th Floor
18 St Swithin’s Lane
London
EC4N 8AD