Data protection and subject access requests
Data protection and the Data Protection Act, how to make a subject access request to find out what data we hold about you, how we process your personal information.
Make a subject access request
Data protection legislation gives you control over your personal data through a number of data rights. This includes:
- accessing your personal data
- correcting your personal data
- deleting your personal data
Asking for your information is called the right of access and is commonly known as making a subject access request.
Make a subject access request
You must make your subject access request in writing.
Email: dataprotectionofficer@woking.gov.uk
Write to:
Data Protection Officer
Woking Borough Council
Civic Offices
Gloucester Square
Woking
GU21 6YL
What to include in your request
When submitting a subject access request, include:
- the ways you have provided your personal data to us in the past
- whether you have provided your personal data to any specific areas of or service provided by the council
This will allow us to process your request more quickly.
In the case of email, you must make it clear whether you asking for data to be accessed, changed or deleted.
Accessing your personal information
You have the right to access the personal data we process about you. Depending on the circumstances, you may have the right to receive your personal data in a digitally portable format.
We will respond to access requests within one month.
Changing your personal information
You have the right to have your personal data changed if it is inaccurate or incomplete. If the accuracy of the personal data is contested, we will store but not use it until its accuracy is verified.
We will respond to requests to change information within one month.
Deleting your personal information
Depending on the circumstances, you have the right to have personal data about you erased.
In circumstances where you cannot have personal data about you erased, you may be able to object to its processing.
Objecting to your personal data being processed
You can object to your personal data being processed. Depending on your personal circumstances and the grounds for processing the personal data, we may be compelled by law to stop using it.
We may contest that there are legitimate grounds to continue using your personal data. In this instance, your personal data will be stored but not used while this is being considered.
Confirming your identity
To ensure your request is processed correctly, you must confirm your identity when making a request.
Submitted with you request, you must include one copy of your chosen identification from Groups 1 and 2; one copy from each group is required.
Group 1:
- passport
- proof of age card
- work or student identification
- travel pass
- other membership card with photo
Group 2:
- driving licence
- utilities bill (less than 3 months old)
- Council Tax bill (less than 3 months old)
- current bank or building society statement
- pension book
Applying on behalf of another person
If you're applying on behalf of another person, you will need to show proof of your identity as well as theirs, plus proof that you have permission to act on the person's (data subjects) behalf.
We will accept one of the following as proof that you have permission to act on the person's (data subjects) behalf:
- a signed declaration by the person (data subject)
- a signed declaration by a health professional confirming that the person (data subject) is unable to make the request themselves
- a document confirming that you are their parent or guardian - if the person (data subject) is a minor
Fees and refusals
In some cases we may have to withhold data if it refers to other people who have not consented to disclosure, or if disclosure could cause damage or distress, or if disclosure would prejudice crime prevention or legal proceedings.
We reserve the right to charge a fee or refuse to respond when requests are clearly unfounded or excessive, such as when they are repetitive.