Subject Access Request Policy

All personal data processed by Gulf Gas and Power UK is within the scope of this Policy.

Data subjects are entitled to ask whether Gulf Gas and Power UK is processing any personal data about that individual and, if so, to be given:

  • a description of the personal data;
  • the purposes for which it is being processed; and,
  • details of who will be allowed to see the personal data.

To be provided with a copy of the information and to be told about the sources from which Gulf Gas and Power UK gathered such information.

Responsibilities

The Data Protection Officer is responsible for the application and effective working of this Subject Access Request Policy, and for reporting to the Executive Team on Subject Access Requests (SARs).

Procedure

Subject Access Requests must be made using the SAR form, which is located on the website and addressed for the attention of the Data Protection Officer.

The data subject must provide evidence as to identity, in the form of a current passport/driving license, and the signature on the identity must be crosschecked to that on the application form.

The data subject must identify the data that is being requested.   GGP UK understand and accept that the data subjects are entitled to ask for all data that the firm holds, without specifying that data.

The application, on receipt by the DPO, will entail collecting the data specified by the data subject, by searching all databases and all relevant filing systems (manual files) in Gulf Gas and Power UK including all back up and archived files, whether computerised or manual, and including all e-mail folders and archives.

The Data Protection Officer maintains a record of requests for data and of its receipt, including dates.

The Data Protection Officer is responsible for reviewing all provided documents to identify whether any third parties are identified in it and for either excising identifying third party information from the documentation or obtaining written consent from the third party for their identity to be revealed.

If the requested data falls under one of the following exemptions, it does not have to be provided:

  • Crime prevention and detection.
  • Negotiations with the requester.
  • Management forecasts.
  • Confidential references given by Gulf Gas and Power.
  • Information used for research, historical or statistical purposes.
  • Information covered by legal professional privilege.

The information is provided to the data subject in electronic format unless otherwise requested and all the items provided are listed on a schedule that shows the data subject’s name and the date on which the information is delivered.

Timescales

Gulf Gas and Power UK will process all Subject Access Requests within one month from the date of receipt of the SAR.

Gulf Gas and Power UK accept there are no circumstances in which an extension to that one month will be provided, and failure to provide the requested information within that one month is a breach of the GDPR.