Data Subject Rights and Subject Access Requests

Individuals who wish to enquire about the data the University holds on them are required to make a "subject access request". Detailed below is the process for requesting access to the personal information we may hold.

What am I entitled to?

Under Article 15 of the GDPR an individual can ask the University:

  • If we hold their personal information;
  • What we use this information for;
  • Provide the individual with a copy of that information;
  • Provide details of the purposes for which the University uses the information and who it is shared with.

An individual may request that incorrect information is corrected.

In certain circumstances, an individual may, also, request that processing of their personal information is restricted or information is erased.

An individual is entitled only to their own personal data. This does not include information relating to other people, unless they are acting on behalf of that person.

If the request does not relate to personal information, then it may be a request under the Freedom of Information Act 2000.

What will I receive?

If you are a member of staff and have requested to see your HR file, you will be invited to the University to view your file.

If you have requested data, depending on the volume of data we may contact you and ask if it is more preferable for it to be supplied in electronic format. Otherwise we will supply hard copies of data.  

There may be a restriction on the data you are provided. The Data Protection Legislation provides for certain exemptions which mean we may not be able to disclose it to you. For example, we are unable to provide third party data or data which would affect a Police investigation. If this is the case we will contact you and let you know the reasons why we are unable to provide the information.

If we do not hold any information we will confirm this in writing to you as a 'nil return'.

How long does it take?

Under the Data Protection Legislation the University is required to respond to subject access requests within 1 month from the day after receipt of the request. Please note, the 1 month period begins from receipt of request and ID. Therefore, it is suggested you send all your documentation as early as you can to avoid any delay.

What can I do if I am unhappy with the response?

If you are unhappy with the subject access response, please let us know. You can write to Data Protection Officer, University Secretary Directorate, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

If you remain unsatisfied with the University's response please contact the Information Commissioner. They can be contacted as follows: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Further details on the Information Commissioner and their role can be found on their website www.ico.org.uk.

What can I do if I think the information is wrong?

If you think the information we hold is incorrect you are advised to contact us in writing and ask us to review the data. You may contact us via email at dataprotection@wlv.ac.uk or in writing to Data Protection Officer, University Secretary Directorate, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

Who can request personal information from the University?

The following individuals can request personal information from the University:

  • The individual whose information is held (the data subject)
  • A third party acting on behalf of the individual - evidence that they are acting on behalf of that individual must be provided.

Can someone make a request on my behalf?

In some circumstances, individuals ask organisations such as Citizens Advice or a solicitor to act on their behalf. If this is the case, those acting on your behalf must provide evidence the individual (the data subject) has consented to the individual to act on their behalf. This consent must be sent to the University with the written request for data.

How do I make a subject access request?

Valid subject access requests require:

i. A clear indication that you wish to obtain information, which may be held about you, preferably in writing

ii. Proof of identity

We cannot release data unless both of these are provided.

i. Written request

While, subject access request need not be made in writing, it is recommended that you submit your requests in writing to ensure that these are processed without delay.

We have a subject access form which you may like to use or if you prefer, you can write a letter to us. Both are valid means of making a subject access request. Your request can be emailed to dataprotection@wlv.ac.uk or posted to:

Data Protection Officer

University Secretary Directorate

Offices of the Vice-Chancellor

University of Wolverhampton

Wulfruna Building

Wulfruna Street



If you have difficulties completing the form or making a written request, please contact us on 01902 322602 or dataprotection@wlv.ac.uk and we will be happy to help you.

ii. Proof of identity

We require two types of id - one photographic, such as a copy of a driving licence or passport or and another which shows you address, such as a utility bill etc. Please send these copies with your request to the above address. We require this identification to be certain we are releasing data to the correct person.

What other rights do I have?

Under the Data Protection Legislation individuals have other rights associated with the right to be informed, the right to rectification, and in some circumstances, the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing, as well as, the right not to be subject to automated decision making.

Should you wish to excercise any of the rights available to you, you may write to us at the address above or dataprotection@wlv.ac.uk

Page updated on: 23/05/2018 dataprotection@wlv.ac.uk