care leavers. Authorities need to ensure that they have their own data protection policies in place and satisfy themselves that they are complying with the Data Protection Act 2018 when processing personal information. 4.31. Where young people have complex needs and a range of agencies are involved in supporting their pathway plan, it may be helpful to agree arrangements for information sharing at a multi-agency meeting to confirm or to review the pathway plan. Responding to the request for information 4.32. Requests for access to care files must be made in writing and, if necessary, the care leaver should be supported to do so. When an application has been 40 received from a care leaver, it is important that the request is acknowledged promptly and in writing, or other appropriate forms of communication if required. The care leaver should be informed about the process and procedure, timescales for dealing with such requests and the services that the authority is able to provide. 4.33. An acknowledgement should be sent to the care leaver within ten working days confirming that records exist. If the authority knows that the care records do not exist, there should be no delay informing the care leaver. The letter should also indicate when they are likely to receive information from the care records and that: • The local authority will locate all existing records relating to the care leaver, including registers from children’s homes; • Under data protection legislation, a local authority has a statutory duty to respond to a request for personal data You must respond to a Subject Access Request (SAR) without undue delay and at the latest within one calendar month of receiving the request. NB Consider whether the request can be treated as complex, if so – you will have a fur