Subject Access Request
What is a Subject Access Request?
Under Data Protection legislation, an individual has the right to ask an organisation for access to, and copies of personal data held about them.
This is the Right of Access, more commonly known as a Subject Access Request (SAR)
How do I make a SAR?
The University has an online Data Subject Rights Request webform to make SAR submissions as easy as possible, but SARs can be submitted in any format.
What information should I include in my SAR?
To help the University locate the information you are seeking access to, please provide as much detail as possible in your request, including:
- first name and surname, and any other names you have previously been known by
- date of birth
- brief description of the information you are seeking access to (e.g. CCTV images, emails between specific teams or individuals where you may be discussed, disability study support plan). Note that the University will perform reasonable and proportionate searches to fulfil your SAR. See 'What happens next' section below for further guidance
- date or date range that the information covers
- areas of the University (e.g. College, School, or Service) and individual members of staff who may hold the information
- proof of identity (photographic ID such as a passport, driving licence, or student card)
If a third party is submitting a SAR on your behalf, such as a lawyer or family member, then in addition to the above, the following is required:
- formal mandate or written consent signed by you, authorising the third party to act on your behalf
What happens next?
If any of the information listed above has not been provided or if your request requires clarification, the University will contact you to request this.
Your SAR will be on hold until all of the information required to take your request forward has been received
If all the information the University needs to take your request forward has been provided, your request will be formally acknowledged. The acknowledgement sets out the following:
Response deadline
- there is a one-month response deadline for SARs, however, the University can extend this to three months in certain circumstances (e.g. where the request is complex)
- where the response deadline falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day
- if your request is received out of University business hours, the response deadline is calculated from the next working day
Reasonable and proportionate searches
The University will perform reasonable and proportionate searches to fulfil your SAR
- this does not extend to collating and reviewing metadata for individual records or audit logs containing personal data
- the Information Commissioner’s Office (ICO) have advised that the University is not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to information sought by an individual under their Right of Access
Information previously sent or received
- the University’s response will not include information that you have previously sent or received
- if you do require this information, please notify the University within one week of receipt of the SAR acknowledgement; any requests for such information received after this date will be treated as a new SAR
How is information for my SAR gathered and sent to me?
All SARs are handled by the University’s Data Protection & Freedom of Information (DP&FOI) Office
In addition:
- the DP&FOI Office uses a network of Data Protection coordinators to assist with gathering information held locally by University Colleges, Schools, and Services in response to a SAR
- if individual members of staff are named in a SAR, they may also be approached directly to gather and return any relevant information they hold
The University does not perform ‘backend’ searches of systems and storage areas in response to SARs.
All searches for information in fulfilment of a SAR are done upfront and with the full knowledge of the relevant information owners
Once the information is gathered, the DP&FOI Office review it to ensure it fulfils the SAR and to prepare it for release.
This may involve withholding information by redaction or omission if it is outside the scope of the request or if certain exemptions allowed under Data Protection legislation apply.
The information is then issued to you with a covering letter in a secure manner, for example via encrypted email or using the University’s secure file transfer site.