Skip to main content

Subject Access Requests

For general information about how the University complies with the Data Protection Act, please see the Data Protection section of this website.

You may also find it useful to look at our Data Protection FAQs.

 

What is a Subject Access Request?

Under the Data Protection Act, individuals are able to make requests to organisations to see any personal information which is held about them. This is called a "subject access request".

The Information Commissioner's Office gives the following definition of personal information:

Personal data means data which relate to a living individual who can be identified –

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

(Information Commissioner's Office)

You may find it helpful to read the guidance from the Information Commissioner's Office on how to request your personal information.

How Do I Make a Subject Access Request?

To make a Subject Access Request, you are asked to complete a DP1 Form, and submit this by email to infocompliance at warwick dot ac dot uk or mail it to:

Administrative Officer (Compliance)
Deputy Registrar's Office
University House
University of Warwick
Coventry
CV4 8UW

In addition you will need to send a £10 fee, together with copies of two forms of ID (passport, driving licence, staff/student badge etc). This fee is payable by cheque (made payable to the ‘University of Warwick’), cash, or debit/credit card. If you wish to pay by cash or card, this is done via Student Reception, Senate House. You will need to contact us in advance of visiting Student Reception in order that we can provide you with the correct paying in code and further instructions.

The Administrative Officer (Compliance) is also available on (024) 761 51020 to answer questions about the University's obligations under the Data Protection Act.

Please be aware that in some cases specific procedures are in place for allowing access to particular types of information, such as access to copies of Student Transcripts. In these cases please follow the existing procedures.

If you are making a request under section 29 of the Data Protection Act, we will consider your query urgent and waive the associated fees. Please inform us that you are invoking this section at the time you submit your request.

How can I get the most out of my subject access request?

A fee is applicable for every Data Subject Access Request, so you are advised to make your request for information as specific as possible to include, details of dates, type of information (eg memos, letters, reports, emails etc), department and the names of authors and recipients, where appropriate. If you know which departments in the University hold information on you, please state this on your application. If you are requesting correspondence, it will help greatly if you can let us know who the correspondence will be from and during which time period. You may find it helpful to read the guidance provided by the Information Commissioner’s Office on how to access your information.

Under the Data Protection Act 1998, if the request is not clear, the University reserves the right to seek additional information from the data subject before processing the request. The statutory period for requests to be fulfilled is 40 calendar days, but you will be advised of the reasons why it may be necessary to extend this period, eg if the original request is not clear and further clarification is required.

What are the timeframes for my subject access request?

Subject access requests will be handled within 40 calendar days of processing your payment. Requests under section 29 will be handled urgently and dealt with as soon as possible.

How will I receive my information?

We will normally provide you with a hard copy of the information you have requested. Once we have prepared a file for you, we will ask if you would prefer us to dispatch this to you via Royal Mail, or if you would like to collect it from our offices. We prefer if you are able to collect information from our offices as this is more secure and minimises the risk that information may be lost or delayed.

What should I do if I am unhappy with the response I receive?

If you have concerns about the response you have received, or are unhappy with the response, you should contact the legal compliance team in the first instance, via infocompliance at warwick dot ac dot uk. If you have reason to believe that there are specific documents missing from your disclosure, it will help us investigate if you can list them or provide us with more information about the location of those documents.

Please note that some historic data may no longer be held due to our ordinary data retention policies. We will have only searched for information held in structured file systems - if the information required is found in an unstructured or partly structured system you will need to give us additional information in order that we can carry out a thorough search. Please see the Information Commissioner's Office guidance on how to access your information for advice on how to do this.

If you are submitting a subject access request relating to an ongoing appeals process, or another kind of ongoing review, some of this data may be considered exempt from disclosure under Schedule 7 of the Data Protection Act. If this is data that you have directly requested, we will ordinarily inform you that we have considered that particular document exempt from disclosure. We will normally be able to disclose these documents once the appeals process is over.

If you are still unhappy with the response you have received, you may go through the University complaints procedure. You may also contact the Information Commissioner's Office and ask them to carry out an assessment.