1. Subject Access Request received
Check Authority. Individual requesting access to own data or sufficient authority eg power of attorney for 3rd party
Verification for data request is done if necessary and holding notifying of the process within 2 working days
Document Action Plan.
Locate personal data within CPRE systems. Log request on subjects ThankQ record. Keep a record of all data stores interrogated
Ownership by a member of Development and Marketing. Document request in SAR / Portability request log
Inform Data Protection Lead
Produce personal data in suitable format (paper copies of scans, extracts of data to .csv files or screen shots) from thankQ CRM database.
The located personal data is reviewed, and where deemed appropriate, exemptions are applied. Records are maintained of the rationale for withholding any data, alongside a copy of the data that was redacted
Identify the Data Subject
For requests made via , unless otherwise requested, data is sent to the subject via within 28 days (with an organisational aim of within 10 working days). Any attached documents are password protected.
If Data Subject requests hard copies of data, confirmation of arrangements for the supply of data is made with data subject
It is recorded on the Data Subject ThankQ record that data has been sent and is also logged on the SAR log
Despatch hard copy data recorded delivery