Data Subject Access Request and Individual Rights Policy

Last updated: 13 October 2026

This policy explains how Data Privacy and Data Security Services Limited, trading as Data Privacy Services (DPS), handles requests for access to personal data and related individual rights. It applies to information for which we are the controller and explains how we assist where we are acting for a client as a processor.

1. Our identity and contact details

Data Privacy and Data Security Services Limited, Cyprus company number HE 432380.
Registered address: Griva Digeni, 51 Athineon Court, Office 202, 8047, Paphos, Cyprus.
UK operating address: 124 City Road, London, EC1V 2NX, United Kingdom.

Privacy contact: info@dataprivacyservices.co.uk, marked “Data Subject Rights”.
Telephone: 0808 101 0155.
Requests can also be made by post to either address or through the Contact Us page. Our Privacy Policy explains our processing more generally.

2. What an access request covers

A subject access request, also called a SAR or DSAR, allows you to ask whether we process personal data about you, receive a copy of that data, and obtain the supplementary information required by applicable law. This includes information about purposes, categories of data, recipients, retention periods or criteria, available rights, the source of data not obtained directly from you, relevant international transfer safeguards, and qualifying automated decision-making where applicable.

The right concerns your personal data. It does not automatically entitle you to every original document, although copies of documents or extracts may be necessary to provide your information in an intelligible form and preserve its context. We consider the scope carefully rather than excluding information because of its format or where it is stored.

3. How to make a request

You can make an access request verbally or in writing. You do not need to mention “GDPR”, use legal terminology, give a reason or complete a particular form. A request does not have to be sent to a designated DPO address to be valid. Staff receiving a request must recognise it and arrange for it to reach the responsible person promptly.

It helps if you tell us your name, a suitable way to contact you, how you have interacted with us, and any dates or areas of information you want us to consider. These details help locate records; they are not a requirement to restrict a request to a narrow category. You may request all personal data within the scope of the right.

Our website’s Cloudflare check protects contact forms against automated abuse. It does not replace proportionate identity verification for a rights request, and you do not have to use the website form to exercise your rights. Ask DPS provides automated guidance and cannot open or manage a rights-request case: please contact our team for case handling. We do not reject a request solely because it reached an unexpected communication channel.

4. Controller and processor responsibilities

We handle requests concerning our own website, business administration, relationship and other controller records. Where the information belongs to a client and we hold it solely under that client’s instructions, the client is normally the controller responsible for deciding and providing the response.

If such a request reaches us, we promptly notify or route it to the relevant controller where appropriate and assist under the applicable agreement. We do not disclose a client’s records without the necessary authority. We explain our role where we can do so without improperly revealing confidential information. Any personal data we separately hold as controller is assessed under this policy.

5. Identity, representatives and children

We take reasonable steps to ensure that information is released to the correct person. If we have reasonable doubts about identity or authority, we may ask for additional information proportionate to the risk. We do not routinely require photo identification, proof of residential address or a completed form where we can verify you by other reliable means.

We explain what is needed and why, request it promptly, and provide an appropriate way to send it. Identity material is used for verification and retained only where justified for that purpose or necessary accountability. Please do not send more sensitive information than we request.

A representative may act for you. We may need evidence of their authority, such as your written authorisation or applicable legal authority, and proportionate identity checks. Rights in children’s information belong to the child. Whether a parent or other person may act depends on authority, the child’s understanding, the circumstances, best interests and applicable law; parenthood alone does not automatically authorise disclosure of every record.

6. Response times

We act without undue delay and apply the time limit required by the law governing the request. The normal period is one calendar month, not automatically 30 days. We record receipt, any necessary verification or clarification, and the response deadline.

Requests under the UK GDPR

The normal period is calculated from the relevant statutory starting point. Where necessary identity information has been lawfully requested, or a permitted fee applies, the rules about receipt of that information or payment may affect that starting point.

Where we process a large amount of information and reasonably need clarification to identify the information or processing activities covered by the request, the UK rules may allow the response clock to pause while that clarification is outstanding. We explain the question, why clarification is necessary and the effect on the deadline. We do not pause merely to ask about a preferred response format, obtain unnecessary information or encourage a narrower request. If clarification is not provided, we assess the information available and make reasonable and proportionate searches rather than automatically refusing the request.

Requests under the EU GDPR

The ordinary period is one month from receipt. Necessary clarification and identity checks are dealt with promptly under the applicable EU rules. We do not automatically apply the UK’s clarification pause to an EU GDPR request or delay recognition until a form is completed.

Extensions

Where legally permitted, complexity or the number of requests may justify an extension of up to two further months. We tell you about an extension and its reasons within the initial applicable month. Ordinary workload, inconvenience or the presence of a dispute does not automatically justify extending or refusing a request. We explain the expected response date and keep you informed where appropriate.

7. How we manage the request

1. Record and allocate. We log receipt, the relevant rights, our controller or processor role and the deadline, and allocate responsibility.
2. Confirm identity and scope where necessary. We make proportionate checks and seek genuinely necessary clarification without imposing a mandatory form.
3. Identify relevant sources. We consider the systems, accounts, teams, providers and periods relevant to the request.
4. Search and collect. We gather relevant personal data and record the search approach and any justified limitations.
5. Review and protect other rights. We assess third-party information, applicable exemptions and necessary redactions.
6. Prepare and check the response. We make the information intelligible, include required supplementary information and check accuracy and completeness.
7. Deliver securely and record the outcome. We use an appropriate delivery method and keep necessary accountability records.

8. Searches, archives and backups

Relevant sources may include email, correspondence, business administration systems, client or supplier records, documents, accessible archives, portal records, support and incident records, and relevant paper filing systems. We consider personal data held by processors on our behalf and seek their assistance where required.

For UK GDPR requests we conduct reasonable and proportionate searches, documenting our assessment where a search limitation is relevant. We apply the corresponding EU requirements to EU GDPR requests. A high volume of information does not, by itself, justify a blanket refusal or an assumption that nothing needs to be searched.

Archives and backups are not automatically exempt. We assess whether relevant personal data is held, accessible or recoverable, whether equivalent information is available elsewhere, and the applicable legal duties. Duplicate copies may be consolidated, but doing so must not omit relevant differences, context or personal data.

We must not conceal, destroy or alter information to prevent lawful disclosure. Necessary preservation measures are considered when a request is received. Legitimate ongoing business processing can continue; relevant corrections or changes must be handled consistently with the request and applicable law.

9. Third-party information, exemptions and redaction

We assess the rights and freedoms of other people whose information appears in a record. Depending on the circumstances and law, we may seek their consent, decide that disclosure without consent is reasonable, redact identifying details or withhold a limited part. The fact that you already know a person’s identity does not automatically justify disclosing all of their information. Conversely, the presence of another person’s name does not automatically justify withholding an entire document.

Other lawful restrictions or exemptions may apply, for example to legal professional privilege or particular information where disclosure would prejudice a legally protected interest. We assess the relevant conditions individually, record reasons and disclose the remainder where possible. Exemptions are not applied solely because information is sensitive, embarrassing or connected to a complaint or litigation.

Where we restrict access, we explain the reason and the available complaint and challenge routes unless the law permits or requires withholding that explanation.

10. Discovery tools and AI-assisted redaction

We may use approved search, discovery, deduplication and AI-assisted review tools to help locate and assess information. Their use must have an appropriate lawful basis, security controls, processor arrangements and any required international transfer safeguards.

Tools support our work; they do not determine whether you have a right of access or make the final legal decision about an exemption. Responsible personnel check relevant outputs, assess proposed redactions and authorise disclosure. We do not upload confidential case records to the public Ask DPS chatbot as a shortcut for handling a DSAR.

11. Fees, repeated requests and refusals

Access is normally free of charge. Where the law allows, a reasonable fee based on administrative costs may be charged for additional copies or for a request that is manifestly unfounded or excessive. A lawful refusal may be possible in the latter circumstances. We assess the particular request and can justify the decision; repeat contact or a difficult relationship is not enough on its own.

Any permitted fee, its basis, payment requirements and effect on the deadline are explained promptly. If we refuse to act, we provide the reasons and explain your right to complain to a supervisory authority and seek a judicial remedy, subject to lawful restrictions on the explanation.

12. How we provide information

We normally provide information in a commonly used electronic form when a request is made electronically, unless you request otherwise or another lawful arrangement is appropriate. We discuss accessibility needs and use an appropriate secure delivery method. Depending on the information, this may include controlled electronic access, encrypted files with credentials sent separately, or secure postal delivery.

We explain relevant abbreviations, codes or extracts so the information is intelligible. We provide a faithful copy of the personal data within scope and the supplementary information required by law. Where a limitation or redaction applies, we explain it as far as the law permits.

13. Requests about other rights

You may also ask us to rectify inaccurate or incomplete data, erase information, restrict processing, provide portable information where the conditions apply, or stop particular processing following an objection. You may withdraw consent and have rights relating to qualifying automated decisions. Each right has its own legal conditions and limitations; we do not assume that every request for deletion requires the removal of records we must lawfully retain.

You may object to direct marketing at any time. We stop that marketing and retain only any minimal suppression information needed to respect the objection. Related rights requests are coordinated while retaining the applicable deadlines and requirements for each.

14. Website chatbot records

The Ask DPS application does not create a stored conversation transcript in the website database. Conversation context exists in the current webpage until cleared, withdrawn or the page is reloaded or left. The application uses a pseudonymous consent grant that expires after 24 hours, together with limited security controls. Hosting logs and OpenAI’s separate processing may have different retention arrangements, explained in our Privacy Policy.

An access request concerns information we actually hold or are responsible for; we cannot reconstruct a deleted conversation that is no longer available. We consider relevant information held on our behalf by providers where the law requires us to do so. If your concern relates to an AI interaction, an approximate date and description can help us identify any relevant information. Do not send passwords or other secrets to identify a chat.

15. Our request-handling records

We retain a proportionate record of the request, verification decisions, searches, deadline calculations, correspondence, redaction or exemption decisions, response and outcome. Access to this material is restricted. Retention is based on the period needed for accountability, complaint handling, relevant legal claims and applicable obligations, rather than indefinite retention of every supplied identity document or duplicate response file.

16. If you are dissatisfied

Contact our privacy contact if you believe information is missing, a decision is incorrect or a request has not been handled properly. Our Data Handling Complaints Policy and Process explains the complaint route. You may contact the relevant regulator directly; raising a concern with us first is not mandatory.

• For UK data protection concerns: Information Commissioner’s Office (ICO).
• For Cyprus concerns: Office of the Commissioner for Personal Data Protection.
• Where applicable, another EEA supervisory authority in your habitual residence, place of work or place of the alleged infringement.

You may also have the right to seek a remedy through the courts. Nothing in this policy limits statutory rights or makes our internal procedure a condition of exercising them.

17. Review and supporting information

We review this policy when legislation, regulatory guidance, services or systems change. Read it with our Privacy Policy and Cookie Policy. Further information is available in the ICO’s right of access guidance and the EDPB’s right of access guidance.