Subject Access Requests relating to Social Care Records | Rhondda Cynon Taf County Borough Council

Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council when handling Subject Access Requests relating to Social Care Records

Accessing Your Social Care Records – What You Need to Know

Asking to see your care records can be a big step. For many people, it’s about finding missing pieces of their story — and that can bring up all kinds of emotions, from curiosity and hope to confusion or even pain.

This notice explains how Rhondda Cynon Taf County Borough Council uses your personal information when you make a Subject Access Request (SAR). A SAR is when you ask to see the information we hold about you or someone you’re legally allowed to represent.

We’re required by law to give you this information, which means some parts of this notice might sound a bit formal, but we’ve done our best to keep it clear and straightforward. Our aim is to help you understand what to expect, what your rights are, and how we’ll support you through the process.

You can also read our main data protection information on our website: Data Protection – Rhondda Cynon Taf County Borough Council

Who’s responsible for your information?

Rhondda Cynon Taf County Borough Council is responsible for looking after your personal information when you make a request to see your social care records. In legal terms, we’re known as the “data controller.”

We’re registered with the Information Commissioner’s Office (ICO), the UK’s independent body for data protection under reference number Z4870100.

Got questions or need help?

If you have any questions about this notice, or if you’re unsure about how your personal information is used when you ask for your records, we’re here to help.

You can contact the Council’s Customer Feedback and Engagement Team:
CustomerFeedback@rctcbc.gov.uk
01443 425005

We’ll do our best to explain things clearly and support you through the process.

What is a Subject Access Request (SAR)?

A Subject Access Request, or SAR for short, is when you ask to see the personal information the Council holds about you. If you’ve had support from Social Care, this might include things like case notes, assessments, or records of meetings with social workers.

There are three main situations where someone can make a request to see social care records:

You’re asking for your own information
You’re helping someone else make a request for example sometimes, a friend or family member may ask you to help them make a request.

You’re legally authorised to act on someone’s behalf for example if you have legal authority to act for someone else, for example, through parental responsibility, power of attorney, or a court order you can make a request on their behalf.

In all cases, we’ll need to confirm your identity and, where applicable, your authority to act on someone else’s behalf before we can process the request.

Whose personal information do we use when handling a Subject Access Request?

When we handle a Subject Access Request (SAR), we process personal data relating to two main groups of people:

1. The person making the request

This could be:

You, if you’re requesting your own records
Someone acting with your permission, such as a friend or family member helping you make the request
Someone with legal authority to act on your behalf, such as a solicitor, parent, or person with power of attorney

2. People whose information is included in the records being requested

Social care records often contain information about other individuals who were involved in your life or care. This might include:

Family members, carers, or friends
Social workers, teachers, or health professionals
Other children or adults who were part of the same case or meeting

What kind of information do we use when you make a SAR?

When you ask to see social care records, we need some basic information to help us find the right records and make sure we’re sharing them with the right person. This includes:

Your name and and how to contact you (like your address, phone number, or email)

Proof of who you are (like a passport or driving licence)
If you’re asking on someone else’s behalf, proof that you’re allowed to do that, for example:
- Confirmation that they’ve asked you to help such as a written letter of authorisation, or
- Proof that you have legal permission to act for them (such as parental responsibility, power of attorney, or a court order)
Any other details that help us find the right records (like the name and date of birth of the person the records are about)

We use this information to check who you are, understand your request, and make sure we handle it safely and legally.

Once we’ve confirmed your identity, we’ll search for the records you’ve asked for. What we find will depend on the kind of support you or your family received from Social Care.

This could include:

Notes or reports written by professionals (like social workers)
Letters, emails, or forms you sent to the Council
Records of meetings, visits, or assessments
Details of support or services you received
Information about your needs, circumstances, or family

Example:

If you’re a care leaver asking to see your own records, we might find information such as your name, date of birth, care plans, placement history, notes from social workers, and details of the support you received while you were in care.

Some of the records may also include information about other people who were involved in your care. We’ll review this carefully and may need to remove or hide parts of the record to protect their privacy, unless it’s appropriate or lawful to share.

Why do we use your personal information?

We use your personal information so we can respond to your SAR safely, accurately, and in a way that supports you. This includes:

Keeping a record of your request
Checking who you are (and whether you have legal authority or permission to act for someone else, if needed)
Asking for more details if we need help finding the right records, for example, about dates, events, or people involved
Searching for the records you’ve asked for
Reviewing the information to make sure it’s appropriate to share
In some cases, contacting people named in the records to ask for their permission before sharing their information
Offering to talk through the response with you first, especially if the records include sensitive or upsetting information, so you can ask questions and choose how you’d like to receive it
Sending your response securely
(Optional) Sending you a short feedback survey, if you choose to fill it in, your answers will be anonymous

What gives us the legal right to use your information?

We’re allowed to use your personal information because the law says we have to. Under the UK General Data Protection Regulation (UK GDPR), our legal reason (or “lawful basis”) for doing this is:

Article 6(1)(c) – Legal obligation:
We’re legally required to respond to SARs under the Data Protection Act 2018 and UK GDPR.

Where does the information come from?

To respond to your SAR, we collect information directly from:

You, when you send us your request
Your representative, if someone is making the request on your behalf

The records we provide you with come from information the Council already holds. These records were created by the social care teams who supported you or your family.

They may include information from:

Social workers or support staff who worked with you
Other Council departments that provided services
Forms, letters, or emails you (or your representative) sent to us
Other organisations that shared information with us to help support you — like schools, health services, or the police

Who do we share your information with?

To help process your SAR, we will need to share your information with other teams within the Council for example, to help find your records, review them, or remove information about other people (this is called redacting).

Outside of the Council, we only share your personal information with:

You – the person the SAR is about
Someone helping you - if you’ve asked a friend or family member to help with your request and you’ve given permission
Your authorised representative – such as a solicitor, parent, or someone with power of attorney, if they’ve shown us the right documents
The Information Commissioner’s Office (ICO) – but only if you’ve made a complaint about how we handled your SAR

In some cases, we may need to contact people named in your records to ask if they’re happy for us to share their information with you. If we do this, we’ll only tell them what they need to know to understand the request, nothing more.

Who helps us handle your information?

We sometimes use trusted companies to help us manage SARs. These companies are called data processors — they only use your information under our instructions, and they must keep it safe and secure. They’re not allowed to use it for anything else.

These are typically companies that provide us with the computer systems and tools we use to send, receive, and store information securely. For example:

Microsoft – helps us send and receive emails and write letters
Egress – helps us send your SAR response securely

How long do we keep your information?

We only keep your personal information for as long as we need it to manage and respond to your SAR. After that, we securely delete it.

Here’s how long we keep different parts of the process:

Proof of identity and address – kept for 1 year, in case we need to confirm we gave the records to the right person
Completed SAR case files – kept for 3 years, in case you have any follow-up questions
SARs that weren’t completed – kept for 1 year, for audit and tracking purposes
SAR register entries – kept for 7 years, to help us monitor and report on how we handle requests

We regularly review our records and delete anything we no longer need.

What are your rights?

You have important rights under data protection law — including the right to see the personal information the Council holds about you.

These rights are there to help you understand, access, and have some control over how your information is used.

You can find more details about your rights and how to use them on our website:
Your Information Rights – Rhondda Cynon Taf County Borough Council

Your right to make a data protection complaint to the Council

If you’re concerned about how your Subject Access Request (SAR) for social care records has been handled, for example, if you feel the response was delayed, incomplete, or not dealt with properly, you have the right to raise a complaint.

We recommend contacting the Social Care SAR complaints team first, as they are best placed to understand the process and help resolve any issues quickly and informally.

If you’re still not satisfied, or you’d prefer to make a formal complaint, you can do so through the Council’s Customer Feedback Scheme:

Make a comment, compliment or complaint online

You can also contact the Council’s Data Protection Officer at Information.management@rctcbc.gov.uk

Still not happy? You can contact the ICO

If you’re not satisfied with how we’ve handled your SAR or your personal data, you also have the right to contact the Information Commissioner’s Office (ICO).

The ICO is the UK’s independent body for data protection. They can look into how we’ve handled your request and help you understand your rights.

We do encourage you to speak to us first if you can - we’ll always try to put things right.

You can contact the ICO here:
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

0303 123 1113