See answers to previous information requests

I am writing to request information regarding Subject Access Requests (SARs) received by your Council. For ease of response, I have structured this request into clearly defined questions with simple response formats. Where exact figures are unavailable, informed estimates are acceptable.

Section 1: SAR Volume
1. Please provide the total number of Subject Access Requests received:
Financial Year; Number of SARs Received
2022/23 (April 2022 - March 2023): 129
2023/24 (April 2023 - March 2024): 134
2024/25 (April 2024 - March 2025): 175

Section 2: Processing Time and Staff Costs
2. What is the estimated average number of staff hours spent processing each SAR (including searching, collation, review, and redaction)?
Average hours per SAR:
This depends on the calculation. Normally we say 1,000 pages is equivalent to 25-30 hours work depending on complexity.

If this includes requests that are refused or withdrawn due to not providing ID, clarification, single document required, refused as trying to get someone else’s data, etc. this would be (rounded) 16 to 22 hours on average for the 3 years mentioned.

If this just covers work on requests that proceed it is 25 to 30 hours average.

3. Which salary band best represents the staff primarily responsible for processing SARs?
£30,000 - £40,000 per annum

4. Approximately how many FTE (full-time equivalent) staff are dedicated to SAR processing?
2FTE with 0.6FTE as support by the Data Protection Officer
Additionally 1FTE on a fixed term contract until November 2026 to aid with clearing backlog.

Section 3: External Costs
5. Please provide the total expenditure on external SAR support (e.g., solicitors, consultants, redaction services) Costs can be approximate however must be indicated as such:
Financial Year External Spend (£)
2022/23: 'Nil' / £0
2023/24: 'Nil' / £0
2024/25: 'Nil' / £0
If no external services were used, please state 'Nil'.

Section 4: Compliance and Timeliness
6. Please provide the following compliance data:
a) 2022/23:
i. Completed Within 30 Days: 63
ii. Required Extension: 66
b) 2023/24:
i. Completed Within 30 Days: 82
ii. Required Extension: 52
c) 2024/25:
i. Completed Within 30 Days: 81
ii. Required Extension: 94

7. How many SARs are currently open or overdue?
Current backlog (open/overdue): 18

Section 5: Complaints and Quality
8. Please provide the following quality indicators:
Financial Year ICO Complaints SARs Requiring Re-work
2022/23: Unknown / Do not record this information.
2023/24: Unknown / Do not record this information.
2024/25: Unknown / Do not record this information.

We have moved to a central model in completing Subject Access Requests this year. We do not have records that are reportable on this and would need to manually review to see this data. It would also depend on the definition of ‘complaint’, and ‘requiring re-work’.

We have had a number of cases go overdue and the majority of these received contact from the individual to express dissatisfaction. Not all went through the Councils complaints process.

9. Has the ICO taken any enforcement action regarding SAR handling in the past three years?
No.

Section 6: Current Tools and Methods
10. What software or tools are currently used to manage and process SARs?
• AXLR8 for case management and logging requests.
• Emails as required to contact individuals.
• Purview to search.
• Any council system that holds the information
• Foxit for redactions
• SharePoint or Secure mail for issuing response.

11. Is any element of your SAR process currently automated?
• Automated searching across systems – to an extent with Purview.
• Automated tracking and deadline alerts

Section 7: SAR Processing Responsibility
12. Which role(s) or department(s) are primarily responsible for processing SARs?
• Information Governance Team – Sits within Legal and the DPO is manager to the SAR Officers.
• Data Protection Officer / DPO – provides support and guidance and manages the team.
• Legal Services (for internal reviews that the DPO has conflict of interest in and to provide advice and guidance)

13. Name the top 3 departments to which SARs were aimed.
1. Children Services
2. Adult Services
3. Highways

Section 8: Complexity Indicators
14.
a) On average, how many separate systems are searched per SAR?
3-5 systems
On average, how many pages are reviewed per SAR?
501-1,000

15. How many SARs required consultation with third parties (e.g., NHS, schools, police, external agencies)?
Financial Year Third Party Consultations
2022/23: We do not record this.
2023/24: We do not record this.
2024/25: We do not record this.