Parish Council Subject Access Request: A Plain-English Guide

Published 6 October 2026. Written with AI assistance.

Understand parish council subject access requests and how they work.

Create an account Sign in

The Problem

Parish councils handle a variety of information, including personal data about residents. This raises questions about how that data is accessed and managed. Residents may wish to know what information a parish council holds about them. This is where a subject access request (SAR) comes into play.

A subject access request allows individuals to ask for copies of their personal data held by the council. This process is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Understanding the SAR process is essential for both councils and residents to promote transparency and accountability.

How It Works

When a resident submits a subject access request, the council must respond within one month. The request can be made verbally or in writing, although written requests are preferable for record-keeping purposes. The council is required to provide the following:

  1. Confirmation of Data Held: The council must confirm whether it holds personal data about the requester.
  2. Access to Data: If data is held, the council must provide a copy of that data.
  3. Information on Processing: The council must explain how the data is used, the legal basis for processing, and how long it will be retained.

It is important to note that certain exemptions may apply. For example, if the data includes information about other individuals, the council may need to redact that information to protect their privacy.

Getting Started

To facilitate the subject access request process, parish councils should have a clear procedure in place. This includes:

  • Designating a Data Protection Officer (DPO): A DPO can help manage requests and oversee adherence to data protection laws.
  • Creating a Template: Providing a template for residents can assist in the request process.
  • Training Staff: Council staff should be trained on data protection principles and the SAR process.

By establishing a clear process, councils can respond efficiently to subject access requests, ensuring that they meet their legal obligations while maintaining transparency with residents.

Generated by TTT AI.