Subject Access Request Procedure

Introduction

Data protection gives people the right, subject to some exceptions, to see personal information which the University holds about them. They may exercise this right by making a Subject Access Request. The University encourages the use wherever possible of its Subject Access Request Form in order to facilitate a timely and thorough response to the request.

Subject Access Requests are managed centrally through a dedicated function which can be contacted via dataprotection@staffs.ac.uk

If you are thinking of making a Subject Access Request to the University, please read the following information before completing a Subject Access Request Form

Do you need to make a Subject Access Request?

If you only want information about a specific incident you may find that you can gain that information by asking for it directly from the department holding it, without having to go through the Subject Access Request procedure. If it is possible to release the requested data to you in this informal way, you may receive it sooner than you are likely to obtain it under our Subject Access Request procedures. If this is not possible, you should make a Subject Access Request.

How to make a Request

All Requests must be made in writing to the University. It will help us to find and provide the information you are seeking most efficiently if you make your request using our standard Subject Access Request Form. Please complete this Subject Access Request Form and send it to us either by post to The Data Protection Officer, Staffordshire University, College Road, Stoke-on-Trent ST4 2DE or by email to dataprotection@staffs.ac.uk. You may be required to send us identification documents and, if so, you may wish to consider the use of encryption software for scans of any identification documents you are submitting electronically. 

PLEASE NOTE that the more general your request, the more likely it is that there will be delay or even a refusal of the request. Delay may occur if your request covers a high volume of data or if we require additional information from you before we are able deal with the request. We may exercise our right under data protection law to refuse any request which is manifestly unfounded or excessive. Help us to help you avoid delay or refusal by being clear about the information you are seeking and, where applicable, the time period you want the search to cover.

What information do we need to start the search?

In order to find the data, you are requesting you will see from the Form that we will usually need the following information:

Your...

  • Name
  • Address
  • Date of birth
  • Staff payroll number (if a member of staff) 
  • Student ID number (if a student) 
  • The area of the University in which you study / work 
  • We may also need to see a copy of your passport or driving licence including photograph page. We will let you know if this is necessary after we have received your Request.

This information is required to confirm that you are entitled to receive the data because you are the person to whom the data relates. If you are making the request on behalf of the data subject, for example, because you are a solicitor acting for the data subject, we will also need to see evidence of the consent of the data subject to the release of the data to you.

If you are searching for specific information, it would be helpful if you would provide as much detail as you can about the actual data you wish to see. For example, you may be looking for a particular set or type of records or records from a particular month or year.

When can you expect to receive your data?

The law allows 1 month in which to provide your data, starting on the date that the University receives a valid request. If it is not going to be possible to supply the data within this timescale you will be contacted with an explanation of the cause of the delay and be told when you can expect to the receive the data and what steps, we are taking.

What data will be provided to you?

You will receive copies of the personal data you have requested, unless one or more of the exemptions contained in the data protection regulations applies. You should be aware that exemptions from disclosure include confidential references; data that is processed for management forecasting or management planning where disclosure would be likely to prejudice the University’s business; data which would be likely to prejudice any negotiations with you or which is covered by legal professional privilege.

Your personal data may be held in a document or database that contains personal data relating to other individuals. To avoid providing you with a third party’s personal data, it may be necessary to redact the other person’s data (to make it illegible to you) or to extract your data from the record. 

You can find more information about these exemptions in the Subject Access Code of Practice on the website of the Information Commissioner’s Office. 

What can you do if you are unhappy with the response to your request?

Please contact the University to clarify any queries about the information you have received or to let us know if any particular data you expected to receive is missing. If you remain dissatisfied with our response to your request, you may complain to the Information Commissioner’s Office (ICO). More advice on how to do this is available by contacting the ICO on its helpline number of 0303 123 1113.