1. Purpose and Scope of the Policy
1.1 Under the General Data Protection Regulations (EU) 2016/679 (GDPR) and the Data Protection Act 2018 (together the data protection legislation) data subjects have certain rights with respect to their personal information.
1.2 This data subject rights policy (policy) sets out those rights and how the entities in the Sanderson Weatherall Group (defined below in Section 2) should respond to a request from a data subject to exercise their rights under the data protection legislation.
1.3 This policy applies to all individuals working within any entity within the Sanderson Weatherall Group, including directors, partners, employees, consultants, contractors, casual and agency workers (referred to together in this policy as personnel).
1.4 All those to whom this policy applies are referred to as you and your in this policy and references to we, us or our refers to the entity in the Sanderson Weatherall Group who controls the way the personal information is used.
1.5 Each Sanderson Weatherall Group company is responsible for ensuring that it complies with the data protection legislation. Protecting the confidentiality and integrity of personal information is a responsibility that we take seriously at all times.
1.6 This policy does not form part of any employee’s contract of employment and it may be amended at any time.
1.7 It is important that you take responsibility for ensuring that you act in accordance with this policy. Any breach of this policy by you will be taken seriously and may result in disciplinary action. It may also result in us breaching the data protection legislation or other legal requirements.
1.8 Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Sanderson Weatherall Group Data Protection Manager whose contact details are provided in the Questions section of this policy.
2. Definitions
2.1 In this policy the following words have the meanings set out below:
2.1.1 a controller means the person or organisation that determines when, why and how to process personal information. It is responsible for establishing practices and policies in line with the data protection legislation. For example, each Sanderson Weatherall Group affiliate will likely be the data controller of the personal information about its employees;
2.1.2 a data subject means an individual about whom we hold personal information, for example an employee, a partner of Sanderson Weatherall LLP, a worker, a contractor, an apprentice, an intern, a job applicant, a customer, individuals employed by customers and suppliers, and professional advisers such as legal advisers;
2.1.3 personal information means information that is about a data subject and which identifies the data subject.
2.1.4 process(ing) means any operation or set of operations which is performed on personal information or on sets of personal information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
2.1.5 relevant group entity means the member of the Sanderson Weatherall Group that is the controller of the personal information; and
2.1.6 Sanderson Weatherall Group means Sanderson Weatherall Group Limited (CN 04870380) and any of its subsidiaries or affiliates which, for the avoidance of doubt, includes Sanderson Weatherall LLP (OC 344770).
3. What Rights do Data Subjects have Under the Data Protection Legislation?
3.1 These rights are:
3.1.1 The right to be informed.
3.1.2 The right of access to personal information.
3.1.3 The right to rectify personal information.
3.1.4 The right to erasure of personal information.
3.1.5 The right to restrict the use of personal information.
3.1.6 The right to data portability.
3.1.7 The right to object to the use of personal information.
3.1.8 The right to withdraw consent.
3.1.9 The right to object to decision which is based solely on automated processing.
3.1.10 The right to complain to the relevant data protection authority.
3.2 The above rights may only apply in certain circumstances and are subject to certain exemptions.
3.3 Please see Schedule 1 for further detail regarding the rights described at Section 2.1.
4. How Long Do We Have To Respond To A Request From A Data Subject To Exercise Their Rights Under The Data Protection Legislation?
4.1 When a request from a data subject to exercise their rights is received it must be dealt with without undue delay and within one calendar month of receipt.
4.2 If the request is complex or the relevant group entity has a large number of requests from the data subject, then the relevant group entity may be able extend the period for response up to a further two months (Article 12(3) GDPR). If an extension is to be sought, this should be done as soon as possible after receipt of the request, and in any event within one month of receipt.
4.3 A failure to respond within one month where the relevant group entity is not able to lawfully extend the time period in accordance with section 4.2, will be a breach of data protection legislation.
4.4 Please contact the Sanderson Weatherall Group Data Protection Manager whose contact details are provided in the Questions section of this policy, to discuss if an extension may be requested before doing so.
5. Can We Charge A Data Subject To Respond To Their Request?
5.1 No, we cannot make a charge for dealing with a request unless the request is manifestly unfounded, excessive, or particularly repetitive, in which case the relevant group entity can charge a reasonable fee (taking into account the administrative costs) (or refuse to act).
6. Is There A Particular Format For A Request From A Data Subject To Exercise Their Rights Under The Data Protection Legislation?
6.1 No, there is no particular format for a request by a data subject to exercise their rights under the data protection legislation.
6.2 A request by a data subject to exercise their rights under the data protection legislation can be made in a variety of ways (including via email and social media or verbally) and does not need to refer to the relevant legislation. For example, a written request by an individual for a copy of their personal information should be treated as a data subject access request.
7. What Should You Do If You Receive A Request By A Data Subject To Exercise Their Rights Under The Data Protection Legislation?
7.1 You must immediately forward any data subject request you receive to the Sanderson Weatherall Group Data Protection Manager. Please see the Questions section of this policy for their contact details.
7.2 If the request was made over the phone then as much information as possible regarding what was requested must be typed into an email and sent to the Sanderson Weatherall Group Data Protection Manager immediately (see below for their contact details). If the request is received in a postal letter, this should be scanned and sent to the Sanderson Weatherall Group Data Protection Manager by email immediately.
7.3 The Sanderson Weatherall Group Data Protection Manager will be responsible for overseeing any response to any such request received and will respond to the data subject in line with the data protection legislation. The Sanderson Weatherall Group Data Protection Manager may ask for input and/or provision of data from teams across the Sanderson Weatherall Group in order to ensure they have fully complied with the request. Due to the time limits for complying, teams requested to assist should treat such requests as a priority.
7.4 Before responding to any request, the identity of the requester must be verified, where it is appropriate.
7.5 No personal information may be disclosed to any third party unless prior authorisation has been obtained from the Sanderson Weatherall Group Data Protection Manager.
8. Questions
If you have any questions regarding a request by a data subject to exercise their rights under the data protection legislation, please contact the Sanderson Weatherall Group Data Protection Manager whose details are set out in the table below.
Data Protection Manager Telephone Number E-mail Office Address
Martin Archer 0113 221 6001 martin.archer@sw.co.uk 6th Floor Central Square, 29 Wellington Street, Leeds, LS1 4DL
9. Policy Review
9.1 The policy will be reviewed annually or more often if deemed necessary by Sanderson Weatherall Group Limited board of directors, for example if there are any major changes in the law or practice or there are changes in the nature of our business, our clients or other changes which impact on this policy.
9.2 Any updates to this policy will be uploaded to the Sanderson Weatherall intranet site at MySW. It is your responsibility to check back regularly to obtain the latest copy of this policy.
10. References / Related Policies
10.1 Sanderson Weatherall Group Customer Privacy Policy;
10.2 Sanderson Weatherall Group Personal Data Breach Security Notification and Reporting Policy; and
10.3 Sanderson Weatherall Group Data Protection Policy.