How to make a Subject Access Request (SAR)

​About Subject Access Requests (SAR)

The Data Protection (Jersey) Law 2018 provides individuals with rights over their personal data.

The law provides you with a right to access personal data which is processed about you by a controller, such as the Government of Jersey.

You also have rights to:

• lodge a complaint with the Data Protection Authority
• request rectification, erasure, restriction of processing (under certain circumstances)
• object to processing on the basis of direct marketing, legitimate interest or public function
• request for your data to be provided in a structured machine readable format in order to transmit to another data controller (portability)

You can request a copy of the data the Government of Jersey holds about you.

Information you can ask for

You can ask for any personal information processed in relation to and which identifies you, or someone you have the authority to ask about (such as a child you have parental responsibility for).

You can ask:

• whether your personal data is being processed by the Government of Jersey 
• the purposes for which your data is being or is to be processed 
• the categories of personal data concerned
  
• the recipients or classes of recipients to whom your data may be disclosed
• how long that data is likely to be retained
  
• where the data was collected from if not from the Government of Jersey
• about any automated decision making about your personal data and the rationale behind it
  
• about safeguards in place where data is transferred to a third country (this usually means outside Europe) or any international organisation
  

If you want to request information about the Government of Jersey which is not personal information you can make a Freedom of Information (FOI) request.

Freedom of Information (FOI)

If you need information from the States of Jersey Police, contact them directly through the States of Jersey Police website.

Redactions and exemptions

There is some information we cannot release. The reasons for this include:

• personal details about other people
  
• information which is subject to ongoing court proceedings
  
• information which would reveal management information or other confidential information
  

 If your information is redacted or withheld for any reason we'll inform you of this.

Keeping records

Information is not kept forever, but some is kept for a long time. Government of Jersey departments maintain a list of what information they need to keep and how long it must be kept for.

These are maintained in line with any legislation and standards that relate to information, for example, keeping financial records for audit purposes. Some public information is also passed to Jersey Archive for safe-keeping or preservation.

Central Data Protection Unit

The personal information you provide will be processed by the Central Data Protection Unit (Chief Operating Office Department part of the Cabinet Office) of the Government of Jersey and will be the Controller for these purposes.

Information will be processed in accordance with the Data Protection (Jersey) Law 2018 for all purposes associated with the administration of requests received under the Data Protection (Jersey) Law 2018. This includes the monitoring of communications to check for compliance with any relevant policies and legislation.

Your request, which may include sensitive information, and any personal information you provide (your name, address and contact details) as part of that request, will be passed to the Data Protection Team authorised to handle your request in the relevant Government of Jersey Department. 

In order to respond to your request, it will be passed, along with the personal information you provided, to the relevant Data Protection Team that can gather the information you have asked for.

That department or departments will source the information, apply any exemptions or redactions as appropriate. You will then be contacted so that the information can be released to you. You may need to provide further identification directly to the department if required.

Information can be supplied to you in a number of ways. These options will be offered when you request and agree by the department at the time of release.

We do not automatically send data via email unless specifically requested. It will be password protected. An individual from the relevant department will call you to inform you of the Password before the information is sent.

Information will not be passed to any other third party outside of the Government of Jersey without your prior consent.

How much it costs

You do not need to pay to make a SAR. However we may charge an administrative fee if you require more than 1 copy.

Before making your request

You only have a right to request personal data about yourself, or about someone you have a right to ask about (such as a child you have parental responsibility for).

If the information you're requesting is not about yourself or someone you have a right to make a request on behalf of, your request may be refused.

Submit a SAR

Submit your SAR by completing the Subject Access Request online form.

Submit a Subject Access Request

You can also email sar@gov.je or submit it by post:

Central Data Protection Unit
Subject Access Request
Government of Jersey
Jubilee Wharf, 24 The Esplanade
St Helier
Jersey
JE2 3QA

Your request will be declined if you're asking for information that is not processed by a Government of Jersey department. Your request will not be passed on to a third party.

When making your request provide:

• your full name
  
• a contact address (email address or a postal address, preferably both)
  
• a clear description of the information you're requesting. Including which departments are involved and the time periods covered
  

You do not have to tell us why you want the information.

You'll be asked to provide proof of your identity and address before the information is sourced and occasionally before it's released.

Writing your request

We cannot process requests which ask for ‘all’ information the Government of Jersey holds about you. Make your request:

• specific
  
• clear
  
• objective

This will help us:

• understand what you're looking for
• identify the information you want
• process ans source your request more efficiently

Timescales

The law states that you're entitled to a response without undue delay and in any event within 4 weeks.

It may take us longer if the information you requested is:

• very complex
• large in volume
• covers a broad period of time
  
• covers a lot of areas

The law states that there can be an extension of a further 8 weeks in some circumstances. If this is the case, we will contact you within 4 weeks of your initial request to let you know that it's going to take longer to process your request.

We may contact you to help you refine or clarify your information request so that we can respond more quickly.

Requests made through third party applications

The Government of Jersey generally requires your email or phone number to contact you. We may require other information for the purposes of confirming your identity or that you have provided a third party with the authority to make a request on your behalf.

We will not process requests made through a third party that require us to create an account with that third party in order to access your contact information or SAR details.

Submit your request using 1 of the methods set out above.

Comments and complaints

If you have a question or a complaint about a SAR you have made, email sar@gov.je.