Data Subject Access Request Process
(last modified 11th May 2018 DSARP 1.0)
Exchange Utility Limited is committed to the fair, transparent and lawful processing of all personal data. To support this, we have published this Data Subject Access Request Process which describes how you can contact us to request your personal data and how we will go about handling such requests. As the subject of your data, you have the legal right to access your personal data that we have processed.
Data Subject Access Request Process Summary
There are five stages to a Subject Access Request:
- Get in touch
- Verifying your request and timeframe for response
- Applicable Charging
- Next Steps
To request your personal data, please, complete the Data Subject Access Request Form here. Although this is not compulsory it will help us get a better understanding of what personal data you require and help us meet your expectations.
Should you not wish to complete a form then we, still, require you to put your request in writing, setting out exactly what personal data you require and over what period(s).
Please send your written requests to
Or alternatively, write to us:
The Data Protection Manager
Exchange Utility Limited
Where you choose not to use our Data Subject Access Request Form, would you, please, provide clear details as to what personal data items you require from us and, where possible, an idea of when such items could have been processed? Such information will allow us to process your request effectively.
As soon as we receive your request we will record and acknowledge it within two business days and provide you with a reference number. Upon validating your request, we may contact you to clarify your request and/or ask for further information to help us locate the personal data.
As we will be retrieving personal data, you will appreciate it is important that we are able to confirm your identity before any personal data is released. We are under no obligation to supply you with any data until we have received satisfactory proof of identity.
Once we have confirmed your identity we are committed to responding to your request within one month. However, if we are unable to meet this timescale, we will contact you as soon as possible to confirm the date by which we will be able to respond – this must not be more than 90 days from the date we first verify your request.
If we are unable to process your request then we will notify you as soon as we can and justify why this cannot be processed.
In most cases, no fee will be charged for a Data Subject Access request. However, where we can demonstrate that the request is unfounded or excessive we may charge an administration fee of £10.00. If this is the case we will contact you beforehand.
Unless you inform us otherwise we will respond to your request electronically, although we can provide you with hard copies upon request.
There may be circumstances where we will be unable to provide you with the personal data items that you have requested. These may include:
- Where personal data has been deleted in line with our data retention policy
- Where personal data also relates to other individuals – unless we can obtain their consent then their identity will be redacted.
- Where the personal data falls within certain categories e.g. legal advice, confidential references, criminal investigation or tax collection.
Should we be unable to provide you with your personal data, we will explain why and refund your fee if paid.
We aim to provide a satisfactory response to all data subject access requests. However, if you have an issue with how we handled your request or with how we have handled your personal data could you, please, let us know so that we can work with you in an effort to resolve it.
You can report a concern or raise a complaint with us initially by contacting us at firstname.lastname@example.org or by contacting a member of staff on 0800 9777 000 who will put you in contact with the data protection manager.
If you are not satisfied with our proposed resolution to your complaint you can raise the matter directly with the Information Commissioner’s Office (ICO). The ICO will take steps to address your concern and provide guidance and support to us to so that we can put things right.
Exchange Utility Limited is a data processor and is registered with the ICO (ID ZA264637).
Details as to how to get in touch with the ICO or report a concern can be found on their webpage https://ico.org.uk/concerns/.