Data Subject Access

What are my rights?

 

Current data protection legislation gives you a right of access to the personal data which organisations, such as the University, hold about you. Requests for access to your personal data are known as ‘subject access requests’ and this page explains how such requests are handled.

If you submit a subject access request to the University, you are entitled to be told whether we hold any of your personal data. If we do, as well as being provided with access to the data, you also have the right:

  • To be informed of the purpose for processing.
  • To be informed of the categories of personal data involved.
  • To be informed of any recipients - or categories of recipient – to whom your personal data has been – or will be – disclosed.
  • To be informed, where possible, for how long it will be kept.
  • To lodge a complaint with the Information Commissioner’s Office (although you may wish to raise any issues with the University in the first instance).
  • To be given details, where possible, of the source.
  • To be informed of any automated decision-making.

These rights apply to personal data in all formats.

Are there any exemptions?

Data protection legislation includes a number of exemptions which set out circumstances in which a request to access personal data can be refused. The most likely situations in which the University could refuse to release information in response to a subject access request are where: 

 

  • The request relates to personal data contained in a confidential reference provided by the University;
  • The request relates to access to an examination script, other than examiners' comments;
  • The release of the information would jeopardise the prevention or detection of crime, or the apprehension or prosecution of offenders;
  • The request relates to personal data which form part of negotiations involving the University, the release of which would prejudice those negotiations;
  • The personal data is covered by legal professional privilege;
  • The personal data relates to management forecasting or planning, and its release to you would prejudice the University's business or activities; or
  • The request relates to access to personal data which have been retained for the purposes of historical or statistical research, the conditions set out in data protection legislation for processing for research purposes have been met, and the results of the research have not been published in a way which identifies individuals. 

In responding to subject access requests, we have to ensure that we protect the rights of other individuals. Information which does not relate to you may be redacted ('blanked out'), particularly if it relates to other individuals. Equally, where releasing your personal data would also reveal information about other individuals, your request may be refused.

If we consider that you have made a request which is manifestly unfounded or excessive in nature (for example because the request is repetitive), it is possible for the University to: 

  • Charge a reasonable fee, taking into account the administrative costs of providing the information; or
  • Refuse to act on the request.

In either of the above circumstances, you will be notified, in writing without delay.

How do I submit a request?

You can make your subject access request by telephone or in person, or in writing, for example by letter or email.

To help us to process your request, please be as specific as possible about the personal data to which you would like access. For example, if you only want personal data relating to your academic progress, or to your interaction with support services, you should indicate that. A general request such as "please send me all of the personal data which you hold about me" is likely to lead us to contact you for further information or clarification.

We require proof of ID to ensure that we are releasing Personal Data to the correct person. Please supply a photocopy or scan (not the original) of one of the following:

  • Your current Aber Card.
  • The pages which identify you in your passport.
  • Your driving licence.

Your ID and request can be emailed to infocompliance@aber.ac.uk (it may be advisable to use a password-protected document containing your request and ID) or it can be posted to the following address:-