The General Data Protection Regulation (GDPR), gives a data subject the right to obtain confirmation that their data is being processed, and where that is the case, access to the personal data.
The right of access to this information is referred to as Subject Access Request (SAR). This procedure explains the process to ensure SARs are handled in line with the GDPR.
You are entitled to access personal data under this procedure if you are:
a) The data subject; or
b) A representative of the data subject who has written consent; or
c) The parent or guardian of a child under 16 years of age: In cases where the child agrees, or it was in the child’s best interest for access to the data to be granted.
Return2Play is not obliged to comply with your Subject Access Request unless it has received:
a) A request in writing.
b) Enough information to identify the data subject.
c) Enough information to identify the information sought.
d) Any request from a personal representative of the data subject should be accompanied by an authority from the data subject consenting to that individual or organisation acting on their behalf.
Requests can be received by post, email, telephone, social media.
If your request is made on-line we may ask you to complete a Subject Access Request Form. We ask that you provide as much information as possible to allow us to narrow down our search.
We will acknowledge your requests promptly.
Complete information will be sent to you, the requester, as soon as possible or within 1 month of receiving a valid request.
1. When Return2Play receives a valid formal request, it will be logged by the relevant department. You will receive a confirmation of this.
2. If more information is needed, you will be contacted to provide further information.
3. Where your request is made online (email or social media) or via telephone you will be asked to complete a Subject Access Request Form.
Once all of the requested information is collated by Return2Play, the SAR response will be reviewed to ensure that:
a) The information is clear and that all coded data is decoded and any business or medical terms are explained.
b) Any information in relation to a third person is removed unless they have given their consent.
If any information has been removed e.g. relating to another person OR all the information asked for is not given, an explanation will be included in a letter to you.
The completed SAR will be sent to you in an easily readable format (email, post) applying appropriate security, within one month of receiving your valid request.
Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Return2Play may:
a) Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
b) Refuse to act on the request.
You have the right to appeal against a decision to refuse access to your information. You have the opportunity to either write a letter of complaint or express your complaint orally with a possible satisfactory outcome.
You are also free to contact the Information Commissioner, who is the compliance lead on Data Protection in the UK.
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Tel: 0303 123 1113 (local rate) or 01625 545 74 (national rate)
We would encourage you to raise any matters with Return2Play before the Information Commissioner.
Whether you are a parent, school teacher, club coach or healthcare professional, we’d love to hear about how we can help you. If you’d like to get involved with Return2Play or learn more about how we can tailor our solutions bespoke to your needs, then please get in touch.