right to access policy
Date Reviewed: 16th march 2026
Effective Date: 2nd november 2023
Next Review Due: 16th march 2027
1: Introduction
This policy outlines the process for recognising and responding to individuals’ requests to access their personal data (known as Subject Access Requests or SARs), in compliance with the UK General Data Protection Regulation (UK GDPR).
2: Process for Handling Access Requests
Types of Access Requests
Individuals have the right to:
- Obtain confirmation that their data is being processed.
- Access their personal data.
- Receive supplementary information, similar to what is provided in a privacy notice.
- Where records contain information relating to other individuals, I may need to redact or remove that information in order to protect their privacy.
Request Formats
Requests can be made verbally or in writing. I will respond to all requests and provide a copy of the information free of charge, unless the request meets specific criteria for charging a reasonable fee.
3: Charging fees
Criteria for Charging
A ‘reasonable fee’ may be charged in the following cases:
- Manifestly Unfounded or Excessive Requests: If the request is manifestly unfounded or excessive, particularly if repetitive, a fee can be charged, or the request may be refused.
- Further Copies: For additional copies of the same information that has already been provided, a fee based on the administrative cost of providing the information can be applied.
- If a request is manifestly unfounded or excessive, particularly if it is repetitive, I may charge a reasonable administrative fee or refuse the request.
Fee Calculation
The fee will be based on the administrative cost of processing the request, not for the information itself. The fee will be communicated to the individual before processing the request.
4: response times
Standard Timeframe
- General Requests: I must respond to requests without delay and within one calendar month of receiving the request.
Extension for Complex Requests
- Complex or Numerous Requests: For complex or numerous requests, the response time can be extended by an additional two months. In such cases, I will inform the individual within the initial one-month period, explaining the reason for the extension.
Calculation of Time Limits
I will respond to requests without undue delay and within one calendar month of receiving the request. In complex cases, this period may be extended by up to two additional months. If an extension is required, I will inform the individual within the initial one month period.
5: identity verification
Verification Process
I will verify the identity of the person making the request using “reasonable means” to ensure the data is provided to the correct individual.
I may request additional information to confirm the identity of the person making the request before releasing personal data.
Where requests relate to children, I may need to confirm that the person making the request has parental responsibility or appropriate authority to access the child’s information.
Electronic Requests
- Format: If the request is made electronically, I will provide the information in a commonly used electronic format.
6: Policy review
This policy will be reviewed annually or as needed to reflect changes in legislation, operational practices, or guidance. Updates will be communicated as necessary.
7: Contact
For any queries regarding this policy or to make a request to access personal data, please contact me at:
Jamie Louise Hollis
Email: adhdslt@outlook.com
Website: www.adhdslt.co.uk
Signed: Jamie Louise Hollis, ADHD SLT
Job Title: Speech and Language Therapist