Making a Subject Access Request
Under the GDPR, all individuals have the right to request a copy of the personal data that the University holds about them. This is called a Subject Access Request (SAR). You are entitled to know whether the University of Liverpool:
- Is processing your personal data.
- The purpose of the processing.
- The categories of personal data processed.
- Where it came from and how long it will be stored.
What information can I request?
You can request a copy of any personal data that the University holds about you. You are only entitled to information about you. You are not entitled to any document that simply mentions you.
A clear and full description of the nature of your request will help us to handle it effectively. Try to be as precise as possible. We would expect you to give us:
- A list of senders and receivers of the information (named individuals).
- A reasonable time period.
- A list of departments or teams where your personal data may be held.
- Any specific topics that the information relates to e.g. data about my resignation.
- The types of documentation required.
The Information Commissioner's Office produce guidance on how to request your personal information.
Will I get all of my data?
We will not provide you with every email or document that contains your name. You are only entitled to information about you.
Information that is not your personal data will not be provided or could appear blacked out within a document. You are not entitled to information about other individuals so we remove the information in this manner.
We may refuse a request if we decide it is manifestly excessive or unfounded. This includes requests that:
- Are for information that you have already been given.
- Are repetitious.
- Are malicious in intent.
Other exemptions enable us to withhold information in specific circumstances. We will tell you if this is the case. The reasons for this may be:
- The information relates to another person.
- The information is related to a criminal or fraud investigation.
- The information may cause you, or another individual emotional distress.
- The information was supplied in confidence or as part of a confidential reference.
- The information is used in management forecasts or ongoing restructuring documents.
- The information is related to an ongoing disciplinary or appeal process. We will normally be able to disclose these documents once the appeals process is over.
How much will my request cost?
Requests are normally free of charge. A ‘reasonable fee’ can be charged if the information requested is excessive or unreasonable (as defined in the GDPR). We may charge a fee if you ask for copies of information we have already provided to you.
How do I make a request?
To make a Subject Access Request, download the Subject Access Request form (Word).
Along with the completed form, we also require evidence of your identity. Please provide a photocopy or scan of an approved form of photographic evidence of your identity. Examples include a photo ID driving licence, passport ID page, birth certificate, University staff or student card or other internationally recognised ID card.
The University will not release personal data to you unless fully satisfied as to your identity.
If you are making a request on behalf of someone else, we need photographic evidence of both your and their identity. We also need written consent for you to make the request on their behalf or proof of legal authority. Please send us identifying details about them e.g. their date of birth and the address we hold for them. In some circumstances, we may also need to request a copy of another form of ID such as their passport or driving licence.
Send your completed form and evidence of identity:
- By email to firstname.lastname@example.org
- By post to the Data Protection Officer, University of Liverpool, Legal & Compliance, Foundation Building, 765 Brownlow Hill, Liverpool L69 7ZX
When will I receive my information?
The University will respond within 30 days from the date your request is received and verified. You will be informed of the deadline for your request in an acknowledgement email or letter, depending on how you make your request to us.
If a request is complex or numerous, this can be extended by a further two months. We will tell you as soon as possible if an extension is required.
Unhappy with our response?
If you are unhappy with the University’s response to your Subject Access Request, please let us know by contacting the Data Protection Officer.
You also have the right to complain to the Information Commissioner’s Office where you are dissatisfied by the University’s response. Please be aware that they may ask you to contact the University in the first instance if you haven’t done so already.
Information Commissioner's Office
Cheshire SK9 5AF
Last update: 24th January 2020