Subject access requests
What you can access
Data protection legislation gives you the right to obtain from the University a copy of any personal data we hold about you. This is called a Subject Access Request.
You also have the right to know:
- Whether or not your personal data is processed by the University
- Where your personal data is being processed
- For what purpose your personal data is being processed.
In most cases, these will be apparent in the context of the personal data you receive from us.
When you receive your data, you may find that some pages have areas blanked out. This is where we have redacted names and personal details of other people where they appeared in the papers in order to protect their privacy. We may also remove some pages altogether where they contain the personal data of other people, as well as your own personal data, and where the balance of sensitivity was greater for the other person. This is an assessment we often make during a subject access request to protect the personal data of other people and will be explained in more detail at the time if it applies to your data.
We may also remove some pages if they relate to other exemptions within the UK Data Protection Act 2018, for example if:
- providing the data would obstruct an official or legal inquiry, investigation or procedure
- providing the data would prejudice the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties
- a claim to legal professional privilege could be maintained in legal proceedings
- a duty of confidentiality is owed by a professional legal advisor to a client in relation to the data
- data is processed for management forecasting or planning only
- data relates to a reference given in confidence
- providing the data would affect the rights and freedoms of others
The University is not able to provide you with copies of personal data held about you by the University of Surrey Students’ Union as they are a separate data controller. All requests for data held by the Students’ Union should be directed to Alex Tolley email@example.com
We can only release copies of personal data to the data subject (the person who the data is about). We will not release it to any third parties unless we have the written consent of the data subject.
Minor day-to-day requests for information and corrections can be taken up with your department or the Registry. You are able to check and amend some data through the student records system
Although you can make a request for your personal data through any means, it is easier for us to locate and provide your data if you complete a Subject Access Request Form. To request a copy of the personal data held about you by the University of Surrey, please complete all the relevant sections of this form which can be found in the section below.
Completion of this form is not compulsory but is designed to help you in providing us with the information we need to deal with your request.
Please send the completed form by email to firstname.lastname@example.org You can also send the form by post if you prefer to:
Information Compliance Unit, Old Estates Building, Stag Hill, University of Surrey, Guildford,Surrey, GU2 7XH.
The University will respond promptly and provide you with your data within one month unless the request is complex in which case we will write as soon as possible to let you know that we may take an additional two months to provide your data.