GDPR provides individuals with the right to be told what information is held about them by an organisation and the right to receive a copy of that information upon request, unless an exemption applies. This policy details how we will respond to a Subject Access Request like this.