Data Protection Subject Access Requests

Individuals who wish to enquire about the data the University holds on them are required to make a 'subject access request'. Detailed below is the process for requesting access to the personal information we may hold.

Individuals requesting their own information

Valid Subject Access Requests require:

  • Full name
  • A clear indication, in writing or verbally, that you wish to obtain information which may be held about you
  • Proof of identify
    • Previous student/staff member – Two forms including one photo ID and one proof of address within the last three months
    • Current student/staff member sent from university email address – one photo ID
    • Current student/staff member sent from personal email address - Two forms including one photo ID and one proof of address within the last three months
    • Individuals other than staff/students - Two forms including one photo ID and one proof of address within the last three months
    • Legal firms acting on behalf of a client – photo ID and signed authority to act

You may wish to use our Subject Access Request Application Form (Word doc 44k) to make your request.

 

Third parties such as the Police, DWP, local council

Valid Subject Access Requests require:

  • Your full name and organisation
  • The exemption listed in the Data Protection Act 2018 you rely on to request the individuals personal data     
  • Clear information detailing the personal data you are requesting and the reason for this. Please provide name, DOB, address and as many other details as possible.
  • Proof of identify if required (e.g. staff ID)

Please complete our Third Party Data Protection Application Form (Word doc 47k) when making your request, if you have not already sent us your own organisations form.

 

Written request

While subject access request do not have to be made in writing, it is recommended that you submit your requests in writing to ensure that these are processed without delay.

You can either use our Subject Access Request form which can be sent via email or post, or write an email or a letter to us. Your request can be emailed to dataprotection@wlv.ac.uk or be posted to:

Information Governance Team, Office of the University Secretary, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

If you require assistance in completing the form or making a written request, please contact us via email at dataprotection@wlv.ac.uk and we will be happy to help you.

The following individuals can request personal information from the University:

  • The individual whose information is held (the data subject)
  • A third party acting on behalf of the individual - evidence that they are acting on behalf of that individual must be provided, by signed authority along with sufficient ID as stated above
  • A third party organisation requesting personal data about an individual – e.g. Police, local council, DWP

We will usually send your personal data to you electronically. If you would like us to supply hard copies of your personal data, please advise us.

If you are a member of staff and have requested to see your HR file, you may be invited to the University to view your file.

There may be a restriction on the data you are provided. The Data Protection Legislation provides for certain exemptions which mean we may not be able to disclose it to you. For example, if the document would reveal the identity of another living individual, we will either redact this information or completely remove the document. We are also unable to provide third party data or data which would affect a Police investigation. If this is the case we will let you know the reasons why we are unable to provide the information.

If we do not hold any information we will confirm this in writing to you.

UK Data Protection Legislation states the University is required to respond to Subject Access Requests within one calendar month from the day after receipt of the request. Please note the one-month period begins from receipt of the request and sufficient ID, therefore, it is suggested you send all your documentation as early as you can to avoid any delay.

The UK General Data Protection Legislation allows organisations to extend this deadline by two months in certain circumstances. If we need to do this with your request, we will contact you and let you know with the reason why.

Once a Subject Access Request has been complied with and a Decision Notice has been issued, if you as the Applicant are not satisfied with the request outcome, you may ask the University to conduct an Internal Review of your request.

This request for review needs to be communicated in writing. You need to specify, with as much detail as possible, what you are disputing about the original decision reached in relation to your Subject Access Request.

The Internal Review process can only review and consider the scope of the original Subject Access Request which was lodged. If an applicant wishes to make any amendments to the scope or asks for additional information, an additional Subject Access Request should be lodged with the University.

You can lodge an Internal Review either by:

  • Email at dataprotection@wlv.ac.uk; or
  • Post at Information Governance Team, Office of the University Secretary, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

The request for Internal Review should be made within 40 days from the date of the original Decision Notice provided. Once an Internal Review request is accepted as valid, the University will aim to respond within 2 months from the day after the date the Internal Review is received. It should be noted that this timeframe is not a legislative requirement and we may need additional time to respond to complete the Internal Review. In this instance we will contact you to inform you of this.

Much like with your original Subject Access Request, you will receive an Internal Review Decision Notice which will explain the decision reached. Once received, if you are still dissatisfied with the outcome, you may, exercise your right to complaint to the ICO.

Further details on how to contact the Information Commissioner can be found on their website at www.ico.org.uk.

If you think the information we hold is incorrect, you are advised to contact us in writing and ask us to review the data. You may contact us by email at dataprotection@wlv.ac.uk or by post at Information Governance Team, Office of the University Secretary, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

 

The UK GDPR encourages controllers to provide individuals with remote access to their personal data via a secure system.

Whether a controller needs to provide individuals with a copy of their data depends on whether they are able to download a copy of the requested information. If an individual can download a copy of their personal data in a commonly used electronic format, then this satisfies the requirement to provide a copy, as long as the individual does not object to the format.

Therefore if you are a student or staff member and can already access and download a copy of the personal data you have requested, we will inform you where you can access and download it.

For further information about this, please see the following ICO guidance.

Page updated on: 16/06/2023 dataprotection@wlv.ac.uk