Subject Access Request form | 3
Your right to request access to your personal records:
The Data Protection Legislation gives you the right to access the personal data relating to you that the British
Red Cross is processing. This is known as a Subject Access Request (SAR).
- The person to whom the personal data refers is the data subject
- The British Red Cross is the data controller
Who can make a Subject Access Request (SAR)?
- Any individual can make a SAR. In addition an individual
may nominate a representative (such as a solicitor or
relative) to apply on their behalf. In this case, there must
be a valid consent signed by the individual who authorises
the release of information to the representative.
- A person who has parental responsibility for a young
child can request access to the child’s records. Release
of records is usually only made in the best interests of
the child. Children may apply themselves – where it is
considered that the child has the competence to be able
to understand the nature and implications of making
a SAR. If they are considered competent, they should
also be consulted regarding any request that has been
made for their records by another individual, for example
a person with parental responsibility. The competence
of the child in respect of requests for records can be
considered from the age of 13.
- For those lacking the mental capacity to make the
request or consent to someone else gaining access to
their records, there are various legal procedures in place.
In some circumstances, you may make a request on
their behalf if you have been granted power of attorney
or agent by a court to manage their affairs. The right of
access to records must be covered in the powers granted
by the power of attorney or court appointment. In the
absence of a power of attorney or court appointment, we
may be able to make a “best interests” decision to release
the records but will need to know more about the purpose
for which they have been requested in order to do so.
Why does the British Red Cross ask for my details?
We ask for your name, address and relationship to the
British Red Cross to enable us to identify and locate your
personal data in our records. Any identifying references
which you can supply to assist us (such as campaign
references, employee numbers etc.) would be appreciated.
Please identify the personal data which you would like
access to and provide any additional information which
would assist us in locating this data as quickly as possible.
In order to ensure that the privacy and security of the
personal information requested is maintained, we must ask
you to provide some proof of identification and address so
that we are certain that we only send personal data to the
data subject or their authorised representative.
Will I be charged for access to the records?
We will provide a copy of the information free of charge.
However, we can charge a ‘reasonable fee’ when a
request is manifestly unfounded or excessive, particularly
if it is repetitive.
We may also charge a reasonable fee to comply with
requests for further copies of the same information.
This does not mean that we will charge for all subsequent
access requests.
The fee will be based on the administrative cost of providing
the information.
How long will it take the British Red Cross to
respond to my request?
We will respond to your request within 30 days from
receipt of your identification information.
What identification information is required?
If you are making a request for information on behalf of
someone else then we will require proof that you are
authorised to receive this information and verification of
your identity.
A data subject may give another person authorisation to
access their records. This authorisation must be provided
in writing with a signature that can be verified against the
data subject’s identity documents.
If the data subject is unable to provide authorisation, then
only a registered authority – such as a court-appointed
agent or someone who holds a lasting power of attorney
for the data subject – can make a Subject Access Request
on their behalf. Evidence of this authority, along with proof
of identify must be supplied for the purposes of
information security.
Any identification information supplied with a Subject
Access Request will be kept securely and in confidence.
The information will not be used for any purpose other than
verification of the requestors’ identities and will be securely
destroyed three years after the request has been closed.
It is advisable to send these documents by Special delivery or
tracked delivery so that they are accounted for in transit and
there is a documented record of their arrival.
How will the information be provided?
In most cases, copies of the records will be made and
sent to you by registered or recorded post (or you can
collect the copies if you prefer). If you would prefer to view
the records, we will arrange a suitable time and location
for you to do so. A qualified member of staff will be in
attendance to provide advice on any aspect of the records.
Arrangements can also be made for alternative
accessibility requirements – please contact us using the
details at the bottom of this page.
Subject Access Request form: guidance
