Important update on Subject Access Requests
Subject Access Requests - What all staff need to know!
Under UK GDPR and the Data Protection Act 2018, individuals have the right to request access to the personal information that North Ayrshire Council holds about them. These requests are known as Subject Access Requests (SARs). Staff should be aware that a SAR does not need to be submitted on a form, in writing, or contain the words "Subject Access Request" or "SAR" to be valid.
A SAR can be received verbally or in writing, including:
- In person at a Council office, school, depot or reception point
- By telephone
- By email or letter
- Through another member of staff
- Via online forms or other contact methods used by the Council
Requests can be as simple as:
- "Can I have a copy of the information the Council holds about me?"
- "I'd like to see my records."
- "Can you send me all the information you have about me?"
If an individual is asking for or acting on behalf of an individual requesting their own personal information, this may be a valid Subject Access Request and should be treated as such.
What Should Staff Do?
If you receive a request for personal information about the individual making the request, do not ask them to submit a formal SAR or redirect them to the Council website. The legislative timescale begins when the request is first received by the Council.
Instead:
- Record the individual's contact details.
- Note what information they are requesting.
- Forward the request immediately to the Information Governance Team via the SAR mailbox:
subjectaccessrequest@north-ayrshire.gov.uk
- If the request was received verbally, provide the Information Governance Team with:
- The requestor's name
- Contact details
- Date and time the request was received
- A brief summary of the information requested
- Your name and service area
The Information Governance Team will arrange identity verification, logging and management of the request in accordance with Council procedures.
Why Is This Important?
Failure to recognise and promptly forward a Subject Access Request can result in:
- Missed statutory deadlines
- Complaints to the Information Commissioner's Office (ICO)
- Increased risk of non-compliance with data protection legislation
By ensuring requests are passed to the Information Governance Team as soon as they are received, staff can help the Council meet its legal obligations and protect individuals' information rights.
Need Advice?
For guidance on Subject Access Requests or any data protection matter, contact the Information Governance Team.
Published August 07, 2026
