Subject Access Request

Your Right to Access Your Data (Subject Access Request)

Under the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), you have the right to request access to the personal data we hold about you. This is known as a Subject Access Request (SAR).

Our Role: Controller vs. Processor

Our obligation to respond to your request depends on our professional relationship with your data:

Where we act as a Data Processor: In most investigative and litigation support matters, we process data on the documented instructions of a client (e.g., a law firm, insurance company, or business). In these cases, the client is the Data Controller. If you submit a SAR to us regarding such a matter, we will refer your request to the relevant Data Controller and assist them in providing a response as required by law.

Where we act as a Data Controller: If we have collected your data for our own business purposes, or where we are acting for a domestic/private client in an independent capacity, we are the Data Controller. In these circumstances, we will respond to your request directly.

What You Can Request

Where we are the Data Controller, you have the right to obtain:

• Confirmation that we are processing your personal data.
• A copy of your personal data. Please note: This relates to the specific information held about you; it is not a right to receive copies of original source documents, internal case files, or litigation reports if the data can be provided in another clear and intelligible format.
• Information about the purposes of the processing and the categories of data concerned.
• Details of the recipients or categories of recipients with whom the data has been shared.

The Use of Third-Party Consultants

To ensure the highest standards of compliance and impartiality, Palatine may instruct an external Data Protection Consultant to manage the administration of your Subject Access Request, or to handle any related complaints or queries.

In such instances:

• The consultant will act as a Data Processor with a limited scope of work.
• It will be necessary for the consultant to review all information relevant to the request to ensure legal compliance and the correct application of exemptions.
• The consultant may communicate directly with you to clarify your request or provide the final response.
• The costs associated with engaging this third party will be the sole responsibility of Palatine.

Legal Exemptions

As a firm specialising in investigation and litigation support, we may be legally required to withhold certain information. This includes data protected by Legal Professional Privilege, data processed for the prevention or detection of crime, or where disclosure would identify a third party who has not consented or a confidential source.

Response Time

We will respond to your request without undue delay and at the latest within one month of verifying your identity. For complex or numerous requests, we may extend this period by a further two months, in which case we will notify you within the first month.

Identity Verification

To protect your privacy, we must verify your identity before processing your request. We will require a copy of a valid ID (e.g., passport or driving licence) and proof of address. The statutory response period does not begin until your identity has been successfully verified.

Fees

There is no fee for a standard Subject Access Request. However, under the Data (Use and Access) Act 2025, we reserve the right to charge a reasonable administrative fee or refuse to act on requests that are deemed vexatious or excessive (including repetitive requests).

How to Make a Request

Please submit your request using the form on this page, or in writing to:

Palatine Research & Data Ltd
Grange Bank, Grange Road
Wirral, CH48 4DY