Make a request for personal data

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to request information the Council holds about you. This includes requesting a copy of your personal records (known as a Subject Access Request) as well as exercising other data protection rights.

A Subject Access Request (SAR) allows you to request a copy of the personal information Waltham Forest Council holds about you.

Examples of personal data you can request:

• Council Tax records
• Tenancy records
• Service interactions and correspondence

We aim to respond to SARs within one calendar month. If your request is complex or we need more details, we will contact you and may extend the response time.

To process your request, we’ll need:

• proof of identity (e.g. passport or driving licence)
• proof of address (e.g., a copy of a bank statement, utility bill, or TV licence)
• if acting on someone’s behalf:
  • proof of their identity
  • evidence of your authority to act (e.g. power of attorney)

You can upload documents securely using our online form.

Once we receive your request, we will:

• review the details and verify your identity
• assess whether your request can be fulfilled based on applicable laws or exemptions
• respond to you with the outcome, either in full, partially, or with a lawful reason for refusal

If any part of your request is refused, we’ll explain why and let you know what to do if you wish to challenge the decision.

Sometimes we may not be able to release the information requested due to legal exemptions, or because the Council does not hold it. If this happens:

• we will explain the reasons in writing
• you will have two calendar months to request an internal review if you’re not satisfied with our response

To request a review, clearly state "Request for Review" in the escalation link provided in your response email.

If you're still unhappy after the review, you can complain to the Information Commissioner’s Office (ICO).

In addition to accessing your data through a SAR, you also have other rights under data protection law. These are known as Individual Rights Requests.

Right to be informed

You have the right to know how and why we collect and use your personal data. This information is usually provided in our Privacy Notices.

Right to rectification

If any personal data we hold about you is inaccurate or incomplete, you can ask us to correct or update it.

Right to erasure (Right to be forgotten)

You can request for your personal data to be deleted in certain circumstances, for example, if it’s no longer needed or was collected unlawfully.

Right to restrict processing

You can ask us to limit how we use your data, such as during a dispute about its accuracy or use.

Right to data portability

You can request your personal data in a machine-readable format so you can reuse it across different services, such as transferring it to another local authority.

Right to object

You can object to your data being used for certain purposes, such as direct marketing or processing based on our legitimate interests.

Rights related to automated decision-making and profiling

You can ask for a human to review a decision made about you entirely by automated means (e.g. a system with no human involvement).

If you're not sure which right applies to your situation, our team can guide you. You can also find more information from the Information Commissioner’s Office (ICO).