Data Subject Access Request

Data Subject Access Request and Your Personal Data Rights

The Rothera Bray policy concerning data subject access requests (DSAR) is as detailed in this policy document.

The Request

This written request can be made to anyone at Rothera Bray but to avoid delay it should be made to the Data Subject Access Team (DSAT) at:

2 Kayes Walk
Stoney Street
The Lace Market
Nottingham
NG1 1PZ

Or by email at datasubjectaccess@rotherabray.co.uk.

For queries in advance of a request you can contact:

Please state clearly that your request is for access to your personal data.

Identification

Before we proceed, we require identification to verify your identity.

You must provide:

  • One form of photo ID (e.g. driving licence or passport)
  • One proof of address (e.g. utility bill no older than 3 months)

How We Will Deal With the Request

  • The data will be provided as soon as reasonably practicable and within 30 days, subject to ID verification.
  • We will confirm whether we hold personal data, provide a description, copies, and reasons for retention.
  • Complex requests may be extended by up to 2 additional months, with notice provided within the initial 30-day period.
  • There is no fee unless the request is manifestly unfounded, excessive, or repetitive.
  • A reasonable fee may be charged for additional copies.
  • We may refuse requests that are unfounded or excessive.
  • Information will be provided in a clear and accessible format, where possible electronically.
  • We may ask you to clarify the scope of your request if data held is extensive.
  • Third-party data will be redacted where necessary.

You Have the Following Additional Rights

  1. Right to rectification
    You may request correction of inaccurate or incomplete data. We will respond within 30 days, extendable by 2 months if complex.
  2. Right to erasure (“right to be forgotten”)
    You may request deletion of personal data where no lawful basis exists for continued processing, including:

    • Data no longer required
    • Withdrawal of consent
    • Unlawful processing
    • Legal obligation to erase
    • Children’s data in relation to online services

    We may refuse erasure where processing is necessary for:

    • Freedom of expression and legal obligations
    • Public health or public interest
    • Archiving, research or statistical purposes
    • Legal claims
  3. Erasure of children’s personal data
    We take special care where children request erasure of data, particularly for online services and forums.
  4. Right to restrict processing
    You may request restriction of processing while accuracy is verified, or where legal grounds are being assessed.
    We may store data but not process it further.
  5. Right to data portability
    You may request your data in a structured, commonly used, machine-readable format where:

    • Data is provided by you
    • Processing is based on consent or contract
    • Processing is automated

    We will provide this free of charge within 30 days, extendable by 2 months if necessary.

  6. Right to object to processing

    (a) Legitimate interests or legal tasks

    You may object based on your circumstances. We will stop unless we have compelling legitimate grounds or legal claims.

    (b) Direct marketing

    We will stop processing immediately upon objection, free of charge.

    (c) ICO contact

    If unsatisfied, you may contact the ICO: