The Data Protection Act (2018), General Data Protection Regulations (GDPR) and our Data Protection Policy give any individual the right to obtain confirmation if their data is being processed by us and to have access to the personal data we hold. The right of access to this information is referred to as Subject Access Request (SAR).

We aim to provide access to personal data within one month of receipt of a subject access request. If a request is complex, an extension of up to a further two months may be requested from the individual making the request. The Data Protection Officer, or a member of our team, will communicate regularly with individuals where this is the case.

A copy of the information will be provided free of charge. However, a reasonable fee may be charged if a request is found to be excessive, or where information is requested repeatedly. We will always notify the individual making a request if we intend to make a charge, and the reason for making a charge.

Subject Access Requests will be accepted from:

• The individual whose data is being requested (also known as the Data Subject).
• A representative of the Data Subject who has written consent (e.g. a parent or carer; a solicitor; a court appointed representative if the Data Subject could no longer manage his or her own affairs; a person with enduring Power of Attorney).
• The parent or carer of a child under 16 years of age: In cases where the child agrees, or it is in the child’s best interest for access to the data to be given.

One of the key principles which underpins UK Data Protection Law is the right of an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This is also known as the ‘right to be forgotten’.

Individuals may have a right to have personal data erased and to prevent processing in specific circumstances such as:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• Where the personal data was unlawfully processed (i.e. otherwise in breach of the Data Protection Act).
• The personal data must be erased to comply with a legal obligation.

Please note that the right to erasure does not provide an absolute ‘right to be forgotten’. Under Data Protection Law the Trafford College Group can refuse to comply with a request for erasure where the personal data is processed for particular reasons. This will always be explained to you by our Data Protection Officer if your request cannot be carried out.

Yes. We take all concerns and questions relating to data protection, use of personal information and the experience of our students and apprentices with the utmost importance. If you would like to speak to the Data Protection Officer with a question or concern before making a formal request, please do not hesitate to contact them by e-mail at dpo@tcg.ac.uk