Data subject access request
Requesting your personal data
Under the current General Data Protection regulations (GDPR), you have the right to access your personal data held by Creative Skillset. If you wish to enquire about the data which Creative Skillset holds on you, you may make a data subject access request (DSAR). The process you should follow to do this is set out below.
You can ask to access the personal data which Creative Skillset may hold about you or you can ask to be provided with a copy of it.
The DSAR is usually free of charge. However, we may charge a nominal fee (in some circumstances) in order to cover some of the administration costs in responding to your request and we are permitted to do this under the GDPR.
What information are you entitled to receive?
If you make a DSAR, you are entitled to know if Creative Skillset holds any of your personal data and what your personal data is used for. You are entitled to receive a copy of your personal data, details regarding the purpose for which Creative Skillset uses the information and who it is shared with.
Only information which is considered to be your personal data will be released under a DSAR. The anonymity of other individuals or other information which is not considered to be your personal data may be protected, as appropriate, by redaction or omission in accordance with the GDPR.
How can I request my personal data?
You can request your personal data by making a DSAR. It will be treated in the strictest confidence and will only be processed by authorised staff in relevant departments who have been contacted in order to locate and process the DSAR.
To make a valid DSAR, you must:
- Put your request in writing to Creative Skillset: in order to speed up the process for us to respond to your request, we ask that you complete Creative Skillset's Data Subject Access Request Form;
- Provide proof of identity: We require a certified copy or original of some form of photographic identification, such as a passport or a driving licence. We require this information to be sure that we are releasing data to the correct person.
- Provide proof of address, such as a recent bill (not older than 6 months).
If you wish for any specific documents to be located and/or areas of Creative Skillset to be searched this should be indicated clearly on the Data Subject Request Form. The more specific you are and the more information that you provide us with, the better we will be able to respond to your request.
If the copies of documents are going to be sent via post, please send your completed form and proof of identity and address to:
Data Protection Officer(s), Creative Skillset, 94 Euston Street, London, NW1 2HA
Or send via email to email@example.com.
Who can request personal information from Creative Skillset?
You yourself can make a DSAR to receive your own personal data. Alternatively, a third party can make a DSAR for you, provided that proof they are acting with the authorisation of that individual is given.
If you are acting on behalf of another individual, Creative Skillset’s Data Subject Access Request Form must be completed. This must be submitted along with signed authorisation confirming the individual’s consent to you acting on his/her behalf and evidence of the identity of the individual.
How long will Creative Skillset take to respond to your request?
We will respond to your request within a reasonable timeframe, but in any event within 30 calendar days of us receiving the required documents and fee (if required). We will let you know if, for any reason, we will be responding outside of this timescale.
Creative Skillset is not obliged to comply with a DSAR from an individual if the request is similar or identical to a request that Creative Skillset has already complied with in relation to that individual. This exemption will not apply if a reasonable interval has elapsed between the two requests and further information has been processed since the first request. Creative Skillset also reserves its rights to act under any other exceptions or exemptions under the GDPR.