You have the right to ask for a copy of the personal information we hold about you, along with information on why and how it is processed. The aim of this right is to help you understand what data is being used and to verify that we are using it for the correct purposes.
This is generally known as making a ‘subject access request’.
How do I make a subject access request?
You can make a request by writing to us, sending an email or asking over the phone or in person. However, it would help us to confirm your identity and find your information more easily – and quickly – if you could use our subject access request form.
If you’d rather just email or write to us you can. We may need to contact you to clarify your request if we don’t have enough information, but we’ll do that as quickly as possible.
If you’d rather speak to us to make your request or are unable to put it in writing for any reason, that’s fine. We’ll write down your request and confirm it with you afterwards.
How will you know who I am?
We’ll need to confirm your identity before we send out any information to you. How we do this will depend on your relationship with us (for example whether you are a student or a member of the public) and the type of information we hold and you have asked for.
We will take all reasonable steps to ensure we are satisfied that you are who you say you are, and that the information held relates to you.
Will there be a fee to pay?
Subject access requests are usually provided free of charge, but there might be a charge in some circumstances. If a request is excessive or repetitive we may charge a reasonable fee to covers the administrative costs of providing the information.
If this is the case we will let you know beforehand.
How long will it take to get the information I ask for?
We will respond to you within 1 month of receiving your request, by either providing you with the information you’ve asked for or telling you why we can’t. But if the request is complex we may extend the deadline by a further 2 months.
If this is the case we will discuss it with you. We’ll tell you why more time is needed, how long we expect it to take and what you can do if you’re not satisfied.
Will I get all the information I ask for?
There are some exemptions that may apply which means you might not get all the information you ask for, for example if providing the information would also disclose the personal information of another person.
In such circumstances we will redact (withhold) some or all of the information. We will explain our reasons for doing this when we provide the response.
When we do provide information we’ll also tell you:
- Why we collect or hold it
- Who else has a copy
- How long we keep it for
- What your rights as a data subject are
- The contact details of our Data Protection Officer
What do I do if I think there’s something wrong?
When you’ve received the response to your subject access request and you think we’re not processing your data lawfully, or something is incorrect, or you have concerns of any kind you can contact our Data Protection Officer (DPO) in the first instance.
Our DPO will advise you on your rights as a data subject and can advise you on how to exercise those rights.