Information Requesters Privacy Notice

Our purpose for processing your personal data is so we can fulfil your information request to us. This enables us to comply with our legal obligations under the legislation we are subject to:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data Use and Access Act 2025
• Freedom of Information Act 2000
• Environmental Information Regulations 2004
• Re-use of Public Sector Information Regulations
• Human Rights Act 1998
• NHS Act 2006

The lawful basis for this is article 6(1)(C) of the UK GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject.

If any of the information you provide us in relation to information request contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights. And Schedule 1 part 2(6) of the DPA 2018 which relates to statutory and government purposes.

We need information from you to respond to you and to locate the information you are looking for.

If you are making a request about your personal data or are acting on behalf of someone making such a request, then we may ask for proof of your identity. If it is relevant, we will also ask for information to show you have authority to act on someone else’s behalf.

The data you provide will be used so that you are able to exercise your lawful rights under the relevant legislation. We may be required to share the data with the relevant departments/employees who may hold the data you require to enable us to respond to your request.

When we receive a request from you, we will set up an electronic case file containing the details of your request. This normally includes your contact details and any other information you have given us. We will also store on this case-file a  copy of the information that falls within the scope of your request.

We will use the information supplied to us to process your information request and check on the level of service we provide.

We have a duty to:

• maintain accurate records;
  
  
• keep records about you confidential and secure;
  
  
• provide information in a format that is accessible to you.

Once a request has been completed, the relevant data will be held by the Information Governance Team for three years (extended to six years if there has been a subsequent appeal) in line with the Records Management Code of Practice

If you are unhappy with how we have used or processed your personal information, including our handling of a Subject Access Request (SAR), you have a right to raise a concern with the Trust Data Protection Officer (DPO).

The DPO can be contacted at the below email address:

rduh.dpo@nhs.net

Please provide as much detail as possible to enable us to look into your complaint.

We will investigate your concerns and respond in line with applicable UK data protection legislation, including the Data Use and Access Act 2025.

Should you remain dissatisfied with our response, you have the right to complaint to the Information Commissioners Office (ICO).  Please find below a link to their website:

Information Commissioner's Office

For further details, please see:

https://www.royaldevon.nhs.uk/about-us/information-governance/fair-collection-privacy-notice/