Data Protection Subject Access Requests

Individuals who wish to enquire about the data the University holds on them are required to make a "subject access request". Detailed below is the process for requesting access to the personal information we may hold.

What am I entitled to?

Section 7(1) Data Protection Act 1998 an individual can ask the University:

  • If we hold their personal information;
  • What we use this information for;
  • Provide the individual with a copy of that information;
  • Provide details of the purposes for which the University uses the information and who it is shared with.

An individual can also request that incorrect information is corrected.

An individual is entitled only to their own personal data. This does not include information relating to other people, unless they are acting on behalf of that person.

If the request does not relate to personal information, then it may be a request under the Freedom of Information Act 2000.

What will I receive?

If you are a member of staff and have requested to see your HR file, you will be invited to the University to view your file.

If you have requested data, depending on the volume of data we may contact you and ask if it is more preferable for it to be supplied in electronic format, such as on a USB stick. Otherwise we will supply hard copies of data.  

There may be a restriction on the data you are provided. Under the Data Protection Act 1998 there are certain exemptions which mean we may not be able to disclose it to you. For example, we are unable to provide third party data or data which would affect a Police investigation. If this is the case we will contact you and let you know the reasons why we are unable to provide the information.

If we do not hold any information we will confirm this in writing to you as a 'nil return'.

How long does it take?

Under the Data Protection Act 1998 the University is required to respond to subject access requests within 40 days from the day after receipt of the request. Please note, the 40 day period begins from receipt of request, ID and payment. Therefore it is suggested you send all your documentation as early as you can to avoid any delay.

What can I do if I am unhappy with the response?

If you are unhappy with the subject access response, please let us know. You can contact us in writing via email (dataprotection@wlv.ac.uk) or in writing to: Office of the University Secretary, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY.

If you remain unsatisfied with the University's response please contact the information commissioner. They can be contacted as follows: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Further details on the Information Commissioner and their role can be found on their website www.ico.gov.uk.

What can I do if I think the information is wrong?

If you think the information we hold is incorrect you are advised to contact us in writing and ask us to review the data. You may contact us via email at dataprotection@wlv.ac.uk or in writing to Office of the University Secretary, Offices of the Vice-Chancellor, University of Wolverhampton, Wulfruna Building, Wulfruna Street, Wolverhampton, WV1 1LY

Who can request personal information from the University?

The following individuals can request personal information from the University:

  • The individual whose information is held (the data subject)
  • A third party acting on behalf of the individual - evidence that they are acting on behalf of that individual must be provided.

Can someone make a request on my behalf?

In some circumstances, individuals ask organisations such as Citizens Advice or a solicitor to act on their behalf. If this is the case, those acting on your behalf must provide evidence the individual (the data subject) has consented to the individual to act on their behalf. This consent must be sent to the University with the written request for data and the fee of £10.

How do I make a subject access request?

Valid subject access requests require:

     i. A written request

    ii. Fee of £10

   iii. Proof of identity

We cannot release data unless all of these are provided.

i. Written request

A valid Data Protection Subject Access request must be made in writing.

We have a subject access form which you may like to use or if you prefer, you can write a letter to us. Both are valid means of making a subject access request. Your request can be emailed to dataprotection@wlv.ac.uk or posted to:

Office of the University Secretary

Offices of the Vice-Chancellor

University of Wolverhampton

Wulfruna Building

Wulfruna Street



If you have difficulties completing the form or making a written request, please contact us on 01902 322620 or dataprotection@wlv.ac.ukand we will be happy to help you.

ii. Fee

The University of Wolverhampton charges a £10 fee for Subject Access Requests, as per Data Protection Act 1998 guidelines.  Cheques can be made payable to The University of Wolverhampton; If you do not have a cheque book you can pay the fee by cash, debit or credit card at any of the Cashiers desks on campus citing reference: Subject Access Request R40011175 coded to G20272-2 account 1072.

iii. Proof of identity

We require two types of id - one photographic, such as a copy of a driving licence or passport or and another which shows you address, such as a utility bill etc. Please send these copies with your written request to the above address. We require this identification to be certain we are releasing data to the correct person.

Page updated on: 06/07/2016 dataprotection@wlv.ac.uk