Subject access request (sar) policy

---

JA Group Services Ltd is committed to operating transparently, lawfully, and responsibly in all matters relating to the processing of personal data. As part of this commitment, the Company recognises and upholds the rights of individuals under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

This Subject Access Request (SAR) Policy sets out, in full, the manner in which JA Group Services Ltd receives, assesses, verifies, processes, and responds to requests made by individuals seeking access to personal data relating to them. The purpose of this policy is to ensure that Subject Access Requests are handled consistently, securely, lawfully, and within the statutory timeframes, while also safeguarding the rights and freedoms of other individuals and protecting the Company’s legal and regulatory obligations.

This policy applies across JA Group Services Ltd and all of its authorised divisions and must be read in conjunction with the JA Group Services Ltd Group Privacy Policy, which provides broader information regarding data processing activities, lawful bases for processing, retention practices, and individual rights.

• JA Group Services Ltd has appointed a Data Protection Officer: Mr Alfie Thomas Holywood Murray, Chief Executive Officer (CEO) 

This policy is issued in accordance with, and gives effect to, the following legislation:

• Article 15 of the UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018

• Under Article 15 UK GDPR, individuals have the legal right to obtain confirmation as to whether personal data concerning them is being processed and, where that is the case, to access that personal data together with prescribed supplementary information regarding how and why the data is processed.

JA Group Services Ltd acts as a data controller in respect of the personal data it processes and is therefore legally responsible for ensuring compliance with these statutory obligations.

A Subject Access Request is a request made by an identifiable individual, or by a person authorised to act on their behalf, seeking access to personal data that JA Group Services Ltd holds about them.

A request does not need to refer explicitly to “Subject Access”, the UK GDPR, or data protection legislation in order to be valid. Any clear communication that reasonably indicates an individual is requesting access to their personal data will be treated as a Subject Access Request and handled in accordance with this policy.

Requests may be made in writing, electronically, or verbally. Where a request is made verbally, JA Group Services Ltd may document the request internally to ensure accurate handling and record-keeping.

A Subject Access Request may be submitted by:

• The data subject themselves, where they are identifiable and competent to make the request; or
• A third party acting on behalf of the data subject, such as a legal representative, advocate, or family member, provided that appropriate written authority or proof of legal entitlement is supplied.
   

JA Group Services Ltd reserves the right to request evidence of authority before responding to any request submitted by a third party and will not disclose personal data unless it is satisfied that disclosure is lawful.

Subject Access Requests should be submitted using one of the following contact routes:

Email:
dataprotection@jagroupservices.co.uk

Postal Address:
Data Protection Officer
JA Group Services Ltd
167–169 Great Portland Street
5th Floor
London
W1W 5PF
United Kingdom

Requests should provide sufficient information to allow JA Group Services Ltd to identify the requester and locate the relevant personal data. Where necessary, the Company may seek clarification in order to process the request accurately and efficiently.

Before responding to any Subject Access Request, JA Group Services Ltd must take reasonable and proportionate steps to verify the identity of the individual making the request. 

This requirement exists to prevent unauthorised disclosure of personal data and to ensure compliance with the integrity and confidentiality principles of data protection law.

Verification may include requests for:

• Official photographic identification
• Proof of current address
• Written authority where a request is made on behalf of another individual
   

Where additional identification is required, the statutory response period will not commence until satisfactory verification has been provided.

Where a Subject Access Request is valid and no exemption applies, JA Group Services Ltd will provide the data subject with:

• Confirmation as to whether personal data concerning them is being processed
• A copy of the personal data held
• The purposes for which the personal data is processed
• The categories of personal data concerned
• The recipients or categories of recipients to whom the data has been disclosed or will be disclosed
• The applicable retention periods or criteria used to determine how long the data is stored
• Information about the individual’s rights to rectification, erasure, restriction, and objection
• Information about the right to lodge a complaint with the Information Commissioner’s Office
• Details of the source of the data, where it was not obtained directly from the data subject
• Information about any automated decision-making or profiling, where applicable
   

Data will normally be provided in electronic format unless the data subject requests otherwise.

JA Group Services Ltd recognises that the right of access is not absolute and that certain exemptions and restrictions may apply under UK data protection law.

Personal data may be withheld, limited, or redacted where disclosure would:

• Adversely affect the rights and freedoms of another individual
• Breach confidentiality obligations
• Reveal legally privileged material
• Prejudice legal proceedings, regulatory functions, or crime prevention
• Fall within a statutory exemption under the Data Protection Act 2018
   

Where information is withheld or redacted, JA Group Services Ltd will explain the basis for doing so, unless providing such an explanation would itself be unlawful.

JA Group Services Ltd will respond to a valid Subject Access Request without undue delay and in any event within one calendar month of receipt.

Where a request is complex or where multiple requests have been submitted by the same individual, the response period may be extended by up to two additional months. 

In such cases, the requester will be informed within the initial one-month period and provided with an explanation for the extension.

Subject Access Requests are generally processed free of charge.

However, JA Group Services Ltd reserves the right to charge a reasonable administrative fee where a request is manifestly unfounded, excessive, or repetitive, or where additional copies of information are requested. Any fee charged will be proportionate and compliant with UK GDPR requirements.

JA Group Services Ltd may refuse to act on a Subject Access Request where it is manifestly unfounded or excessive.

Where a request is refused, the data subject will be informed in writing of:

• The refusal decision
• The reasons for the refusal
• Their right to lodge a complaint with the Information Commissioner’s Office
• Their right to seek a judicial remedy
   

All personal data disclosed in response to a Subject Access Request is subject to strict internal security controls.

Where personal data relates to multiple individuals, JA Group Services Ltd will take appropriate steps to redact third-party information unless consent has been obtained or disclosure is otherwise lawful.

Any concerns or complaints regarding the handling of a Subject Access Request should be directed to:

Data Protection Officer
JA Group Services Ltd
Email: dataprotection@jagroupservices.co.uk

Data subjects also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

This Subject Access Request Policy is a formally adopted policy of JA Group Services Ltd and forms part of the Company’s data protection and governance framework.

The policy is reviewed periodically and updated where required to reflect changes in legislation, regulatory guidance, or organisational practice. 

All Subject Access Requests must be handled in accordance with the most current version of this policy.

For more details regarding your privacy, you may refer to our Group Privacy Policy. 

Last Updated: 12 Jan 2026