Your Rights

Under UK data protection law, you may have a number of rights in relation to personal data.

This page explains those rights in plain English and how they may apply when you use GetMySAR.

For more detailed information, please also see our Privacy Policy, Data Protection page and UK GDPR page.

There is an important difference between personal data held by GetMySAR and personal data held by the organisation you are making a Subject Access Request to.

• If your request relates to personal data held by GetMySAR, you should contact GetMySAR.
• If your request relates to personal data held by the organisation named in your Subject Access Request, that organisation is usually the correct data controller to contact.

GetMySAR helps you prepare and send SARs, but the target organisation is generally responsible for the personal data in its own records.

You may have the right to ask for a copy of the personal data we hold about you and certain information about how we use it.

This right applies to personal data held by GetMySAR. If you want access to data held by the organisation you are making a request to, that organisation is usually the one that must respond.

You may have the right to ask us to correct inaccurate personal data or complete incomplete personal data that we hold about you.

In some circumstances, you may have the right to ask us to delete personal data we hold about you.

This right is not absolute. We may need to keep certain information where we have a lawful reason to do so, such as legal, operational or record-keeping requirements.

In some cases, you may have the right to ask us to limit how we use your personal data.

You may have the right to object to certain types of processing, particularly where processing is based on legitimate interests.

In some circumstances, you may have the right to receive certain personal data in a structured, commonly used and machine-readable format, or ask for it to be transferred to another provider.

Where we rely on your consent to process personal data, you may have the right to withdraw that consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

These rights do not apply in every situation, and some are subject to exceptions or conditions under data protection law.

Whether a right applies will depend on the circumstances, the type of data involved and the legal basis for the processing.

To exercise your rights in relation to personal data held by GetMySAR, please use our contact form.

Please provide enough information for us to understand your request and confirm your identity where necessary.

We aim to acknowledge rights requests within 3 days. Where data protection law requires a substantive response, this will usually be provided within one month, subject to any lawful extension.

If you are unhappy with how we have handled your personal data or your rights request, please contact us first using our contact form.

You also have the right to complain to the Information Commissioner's Office (ICO).

ICO website: https://ico.org.uk/make-a-complaint/