Subject Access Request procedure

A guide to accessing your personal information held by the University

Data Protection – Subject Access Request (SAR)

Introduction

In keeping with the spirit of Data Protection legislation, the University of Leicester is always willing to provide its staff, students, and members of the public access to information held by the University.

This guidance refers specifically to the right of access under Article 15 of General Data Protection Regulation. All individuals have the right to know what information about them is held by the University. The purpose of this is for individuals to verify what information the university holds about them, and confirm whether the processing of the personal data is correct and lawful.

The request to access personal information under article 15 of GDPR is free of charge. However, the University will have discretion to decide whether to charge an individual when the request is repeated or unreasonable.

How to determine the exact nature of your request?

Request for personal data relating to you, i.e. your personal data

Under the terms of the General Data Protection Regulation 2016, individuals are allowed to ask the University for a copy of any personal data held about them as individuals. Individuals are entitled to all personal data that the University holds on computer, electronic or in manual record systems.

In case you wish to make an enquiry about data that relates to yourself, this is known as a ‘Subject Access Request - SAR’. It should be noted that some data may be exempt from disclosure; the University will inform you if any of your personal data has been withheld due to it being the subject of an exemption.

Please note this process only covers requests for your own personal data. Requests for other information held by the University should be directed as a request under the Freedom of Information Act 2000. Please find more information on our website.

How to make a Subject Access Request (SAR) to The University?

• The request should be made by the individual.
• The requestor should provide an ID as proof of identity.
• Request made in writing are the most efficient way to deal with SAR requests. This could be any format i.e. email, letter. The university will make reasonable adjustments for disabled people when they have difficulty making a SAR in writing.
  • The request should be made to:
    Information Assurance Services,
    University of Leicester
    University Road
    Fielding Johnson Building
    Leicester
    LE1 7RH
    
    ias@le.ac.uk
    +44 (0)116 229 7945

• The written request should contain the following details:
  • Full name;
  • Date of birth;
  • Academic department or Corporate division;
  • Student number or University employee number, if known;
  • Information you would like to access such as:
    • Student: Student file, marks, counselling records, disability records
    • Staff: HR records such as employment file, personal development discussions, safety records, etc.
  • Location where the information is likely to be held, if known.
  • Contact details i.e. email, address, phone number.

Please note that if the request is made in person or by phone to any academic department or corporate division, the individual will still need to meet requirements 1-4 above. This is necessary in order to verify requestor’s identity and have evidence when the request was made. Also, it is important to have a record of the type of information requested. In this case the individual will be advised to contact Information Assurance Services.

How long will The University have to respond to a Subject Access Request?

• The university will acknowledge in writing the receipt of subject access request within 10 working days.
• The University will have one calendar month to provide you with a response. This period starts counting from the day the University has received proof of identity from the requestor.
• The response will be in writing and the information will be provided either in hard copies or electronic format according to requester’s preference.

Can The University charge or even reject a Subject Access Request (SAR)?

As expressed above the exercise of this right will be free of charge. However, if the request to access personal data is unfounded or excessive, the University is able to charge a reasonable fee for the administrative cost the university must incur to comply with the request.

This is particularly relevant if the request is repetitive and without reasonable justification.

In rare cases, the University might refuse to respond to request. This is rare and there will always be an explanation for the decision along with advice to contact The Information Commissioner (supervisory authority) in case of dissatisfaction.

Example

A student made a SAR in January 2017, the University provided the information within the month time frame and in April 2017, the student requests the same information again. The university may have two options:

1. To charge the student for this request as it is repetitive and only a few months have passed since the last SAR. The time and cost the university will incur processing this request should be covered by a fee
2. The university will evaluate whether the new SAR is reasonable as the student has this information already and it is likely that nothing has changed since the last SAR. In this case, the university might refuse to provide the information explaining the grounds for the response. Regardless, the student will have the right to complain to the ICO (supervisory authority)

What type of information will be included in a response provided by The University to a Subject Access Request?

The University will confirm whether the individual’s personal information is processed and provide the information requested.

In addition, The University will provide the following information within its response:

• The purpose for processing this information;
• Specific categories of personal data which is processed;
• Confirm whether the data has been or will be disclosed to third parties and/or other countries;
• Confirm data is stored according to the retention schedule;
• Individual rights applicable;
• Information about the individual’s right to complain to the Office of The Information Commissioner;
• Confirm the existence of automated decision making, including profiling. Which involves the processing of the individual’s personal data.

In case you have further questions please contact:

Information Assurance Services
University of Leicester
Fielding Johnson Building
University Road
Leicester, LE1 7RH

ias@le.ac.uk
+44 (0)116 229 7945