Subject Access Requests
Individuals wishing to have access to personal data held by The BRIT School under the Data Protection Act ("the Act") can send a completed subject access request (SAR) form to the data protection coordinators.
The Subject Access Request (SAR) Form, and where to send the completed form can be found below.
By Post to: Data Protection Officer (SAR), The BRIT School, 60 The Crescent, Croydon CR0 2HN
Or by email to: dpo-brit@brit.croydon.sch.uk
Information and procedure for responding to subject access requests
The personal data requested should be clearly identified. It may be necessary to confirm the identity of the data subject and/or the person making the request. The school will respond to requests within 1 calendar month of receipt of the completed form (provided sufficient information has been given to the school to enable the school to process the request), or, in the case of exam marks, up to five months from the time when the school has sufficient information to process the form.
General guidance when requesting subject access to emails
Data subjects are entitled to have access to their personal data held in the form of emails under the Act. However, data subjects must supply enough information to enable the school to locate the relevant emails. As a minimum, the following information must be provided to the Information Rights Officer when completing the form:
The fact that the data may be held in the form of emails;
The names of the authors or recipients of the messages;
The dates or ranges of dates upon which the messages have been sent;
Any other information that might assist the school in locating the data.
Please note that failure to provide information reasonably required to narrow down the search could result in the School being unable to comply with a subject access request.
Information containing personal data about other people (third parties)
Some information may contain personal data relating to third parties. The request may therefore lead to a conflict between the data subject's rights of access and the third party's rights over their own personal information. In responding to subject access requests, the school will need to ensure that the rights of those third parties are not compromised by releasing the information. As the obligation of the school is to provide information rather than documents, redaction or editing may be used so that third-party information does not form part of the requested information.
The school may also ask for consent from a third party. Where consent is not given, in line with the Information Commissioner's Subject Access Code of Practice (we are currently awaiting an updated version of this documented), the school will consider whether it is reasonable in all the circumstances to disclose the email without the third party's consent.
Retention
Subject access requests will normally be held by the School for three years after the final action.