Data Protection requests
Under the Data Protection Act 1998 (DPA), you have the right to apply for a copy of the personal information held about you by Southwark Council. A request for information about yourself is known as a ‘subject access request’, as you're the data subject.
Making a subject access request
For a request to be valid under the DPA it must:
- Be in writing (emails or letters)
- Include your name, any other names you're known by and a postal or email address
- Describe the information you're seeking in detail
- Include photocopies of two forms of identification (don't send original documents in the post)
Forms of identification:
- driver’s licence
- government issue photo identification
- NI Card
- NHS Card
- ID Card eg Union Membership
- Tenancy Agreement
- credit or bank card
- birth certificate
Proof of residence:
- rent card/book
- benefit book
- council tax bill
- utility bill within last 3 months
- credit or bank card statement within the last 3 months
- letter from a government department
You can make a subject access request by emailing firstname.lastname@example.org.
You can also contact the Corporate Freedom of Information Officer at:
Finance and Corporate Services
PO Box 64529
London SE1P 5LX
Tel: 020 7525 7511
If you require assistance writing your request, contact our customer service staff at a one stop shop location.
What happens next
We may contact you for further information in order to identify and locate the information sought. We might ask for details such as:
- type of data (eg letter or email)
- names of authors or recipients of emails
- teams or areas of the council in which you know data exists
- date or time ranges within which the data may have been created or sent
- subject of data or ‘keywords’
- what your working and business connections are to the information
We can help you make the request reasonable so you can access the most important information.
You may also need to provide further proof of identification. It is important that we do not send personal data to someone pretending to be you, so please do not be offended if we ask for ID. It means we're looking after your data carefully and checking it goes to the right person.
We're required to respond within 40 calendar days of receiving everything we need to process your request, either with the information you require or with explanation of delays.
Information we can tell you
You're entitled to be told if we're using your personal data, or someone is doing so on our behalf.
You can then be given a description of the data involved; why it is being processed; who it may be disclosed to; the source of the information and the logic behind processing the information.
If no data is held, or the data falls into a category which is exempt from disclosure, you will be notified in writing.
What information may not be released
Some information will be exempt from disclosure, such as personal data relating to other people, information that could prejudice the prevention or detection of crime, or legal advice.
If any information you seek has been withheld from you, you will be informed in writing with an explanation as to why this is the case.
Please note that the council will not be obliged to comply with a request which simply states "I want everything the council holds on me.”
Subject access requests on behalf of third parties
The law prevents the council from providing you with information about another person without written and signed authorisation from that person. If you need to make a subject access request on behalf of someone else, you will need to follow the process for making a request outlined above, and provide written authorisation from the data subject.
Sometimes we have the discretion, or as required by law, to release information to our partners or other professional organisations; for example the police, other local authorities or solicitors.
If you wish to make a request under section 29 or section 35 of the DPA, use the Southwark Disclosure form (docx, 24kb).
Last updated: 06 July 2017