Re: RBWM Oversight of Achieving for Children (AfC) Data Protection Compliance
We request the following information from RBWM:
1. Any written contract, service level agreement, or commissioning specification between RBWM and AfC that sets out AfC's obligations in respect of compliance with data protection legislation, including the UK GDPR and the Data Protection Act 2018.
2. Any written performance monitoring framework, report, or audit through which RBWM monitors AfC's compliance with its data protection obligations, including compliance with Subject Access Request deadlines.
3. Any written communication between RBWM and AfC in the last 12 months in which AfC notified RBWM of difficulties in meeting statutory SAR deadlines or of a backlog in its Right of Access service.
4. Any written communication between RBWM and AfC in which RBWM raised concerns about AfC's data protection compliance or required AfC to take remedial action.
5. Whether RBWM was aware, prior to receiving correspondence from us, that AfC's Right of Access service had a large backlog and was unable to meet statutory deadlines. If yes, please confirm when RBWM became aware and what action was taken.