Disclaimer, copyright, privacy, cookies and accessibility

Make a Subject Access Request (SAR)

Under the General Data Data Protection Regulation (GDPR) an individual has the right to request all personal data that an organisation holds about them by making a subject access request.

You can make a request to access your personal information online or by post.

Make a Subject Access Request here...

Post - please send a letter to use at:

Customer care & improvement team,
London Borough of Sutton,
Civic Offices,
St Nicholas Way, Sutton,
SM1 1EA 

Before you make a Subject Access Request, please take the time to read the following information.

What information do I need to provide?

A clear, specific request

The Council does not have to start working on a subject access request until you have provided enough information for us to find the personal data.

For example, a request for 'all of the personal data held on me' is not specific enough for us to find your personal data.

The Council processes personal information for many reasons, below is a list of the most requested information types:

  • social care information
  • housing benefit files
  • council tax information
  • employment files

You will need to state which Council departments you have dealt with.

If you are requesting social care information then please provide details of any family members who were also involved with social care. This will allow us to conduct a more thorough search of our social care records and allow us to provide you with more information 

Current identification

The Council takes great care to ensure that personal data is only disclosed to those who are authorised to access it. For this reason you will need to provide a form of ID from each of the lists below in order to request your personal information.

Examples of acceptable name identification:

  • driver's license
  • passport
  • birth certificate

Examples of acceptable proof of address:

  • utility bill
  • bank statement
  • council tax bill

Address ID is necessary in order to ensure that your personal data is being posted to the right place. If you would rather pick up your data by hand then please let us know.

Identification can be included within your postal application or a clear scanned/photographed copy can be emailed to us at foi@sutton.gov.uk

How long does a subject access request take?

The General Data Protection Regulation gives data controllers one month to complete a subject access request. This time starts from when the Council receives a clear request and enough identification to be sure that the request is from the data subject. 

Some social care files are very large and may take longer than a month to complete. If this is the case with your request we will contact you.  

Children's Information

Information about children may be released to a person with parental responsibility. However, the best interests of the child will always be considered. Even if a child is very young, data about them is still their personal data and does not belong to anyone else. It is the child who has a right of access to the information held about them.

Before responding to a request for information held about a child, we will consider whether the child is mature enough to understand their rights. In normal circumstances, we consider a child of 12 or older is old enough to understand their rights.

For children under the age of 12, we will consider applications from whoever has parental responsibility for the child. We will take into account details of the specific case. 

What happens if some or all of my request is refused?

The Council is permitted to withhold information if it falls under one of the exemptions in the Act. If you are unhappy with the decision, you can write to the Information Commissioner to request a review of that decision.

What if I am not happy with the response to my request?

The first stage is to contact us to request a review of your request. The General Data Protection Regulation does not specify how long a review should take but in most cases the Council will attempt to review your request within 20 working days.

If you are still unsatisfied after a review then the next stage is to contact the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 113