The General Data Protection Act 2018 gives individuals the right to be told what personal information an organisation holds about them and, unless an exemption applies, to receive a copy of that information. Individuals can obtain copies of their own personal information by submitting a Subject Access Request.

Who can make a request?

Only the following people can request to see personal information about an individual:

  • The person the information is about (the ‘data subject’); this includes somebody under 18 if they understand the nature of the request
  • An agent acting on behalf of the data subject, eg. a solicitor
  • A person acting under an order of the Court of Protection or acting within the terms of a registered Lasting Power of Attorney in relation to somebody who lacks the capacity to manage their affairs and make the request themselves
  • The parent or legal guardian of the data subject if they are under 12 or lack sufficient maturity until a later age

You will need:

If you are requesting information about yourself, or about your child, you will need to provide copies of:

  • Photo ID, eg a passport or driver’s licence
  • Proof of address (if this is not included in your photo ID), eg. a Council Tax registration form, Council or Housing Trust rent book, medical card or utilities bill
  • Proof of parental responsibility, if applicable
  • If you are requesting information about your child and they are aged 12 or over and capable of understanding the request, you will also need to upload a signed letter from them giving consent for you to act on their behalf.

If you are an agent acting on behalf of the data subject, you will need to provide:

  • A letter of consent signed by the data subject

If you are requesting information on behalf of an adult who lacks the capacity to make their own request, you will need to upload:

  • Proof that you have the legal right to make the request

Before you start:

Under the Data Protection Act, there is some information we are entitled to remove from your file(s) before giving to you.

Information we hold about you is exempt from disclosure and cannot be given to you if it was obtained for the following purposes:

  • The prevention and detection of crime;
  • Negotiations with the data subject request maker;
  • Management forecasts;
  • Confidential references provided by YMCA South Molton however not references provided to YMCA South Molton
  • Data covered by legal professional privilege;
  • Data used for research, statistical or historical reasons.

What happens next:

We may need to contact you for further details before we give you the information you have requested. Your information will be provided within one month of the date we receive your ID.

To ask for copies of information held by YMCA South Molton about you or a child, please write with the relevant identification information to:

The Data Controller

YMCA South Molton

Mill Street

South Molton

EX36 4AS

Or email preferences@ymcasouthmolton.org.uk however, this is not a secure mailbox, so if you use this email address you should be aware that you are sending data unencrypted.

We will provide the information wherever possible, in line with the General Data Protection Act 2018.