You are entitled to know whether the University of Liverpool:
- Is processing your personal data.
- The purpose of the processing.
- The categories of personal data are being processed.
- Where your personal data came from and how long it will be stored.
To make a request, download the Subject Access Request form (Word).
Along with the completed form, we also require evidence of your identity. Please provide a photocopy, picture or scan of an approved form of photographic ID. Examples include a photo ID driving licence, passport ID page, birth certificate, University staff or student card, or other internationally recognised ID card.
The University will not release personal data to you unless fully satisfied as to your identity.
If you are making a request on behalf of someone else, we need photographic evidence of both your and their identity. We also need written consent for you to make the request on their behalf or proof of legal authority. Please send us identifying details about them e.g. their date of birth and the address we hold for them. In some circumstances, we may also need to request a copy of another form of ID such as their passport or driving licence.
Send your completed form and evidence of identity:
- By email to legal@liverpool.ac.uk
- By post to the Data Protection Officer, University of Liverpool, Legal & Governance, University of Liverpool, Foundation Building, 765 Brownlow Hill, Liverpool L69 7ZX. Due to hybrid working, please use email wherever possible.
We keep records of our correspondence with you about your request and records containing your name, contact details, a summary of your request, and your relationship with the University (if known). If you are asked to verify your identity because you are requesting access to your personal data records, we will store a copy of your identity documentation.
We use this information to ensure that the University complies with our legal obligations, demonstrate, and monitor our compliance and analyse who we are receiving requests from to monitor demand. Read our Information Compliance Privacy Notice.
What information can I request?
You can request a copy of any personal data that the University holds about you. You are only entitled to information about you. You are not entitled to any document that simply mentions you.
A clear and full description of the nature of your request will help us to handle it effectively. Try to be as precise as possible. We would expect you to give us:
- A list of senders and receivers of the information (named individuals).
- A reasonable time period.
- A list of departments or teams where your personal data may be held.
- Any specific topics that the information relates to e.g. data about my resignation.
- The types of documentation required.
The Information Commissioner's Office produce guidance on how to request your personal information from a public authority.
University staff can request copies of Occupational Health via the University's online store.
Will I get all of my data?
We will not provide you with every email or document that contains your name. You are only entitled to information about you.
Information that is not your personal data will not be provided or could appear blacked out within a document. You are not entitled to information about other individuals so we remove the information in this manner.
We may refuse a request if we decide it is manifestly excessive or unfounded. This includes requests that:
- Are for information that you have already been given.
- Are repetitious.
- Are malicious in intent.
Other exemptions enable us to withhold information in specific circumstances. We will tell you if this is the case. The reasons for this may be:
- The information relates to another person.
- The information is related to a criminal or fraud investigation.
- The information may cause you, or another individual emotional distress.
- The information was supplied in confidence or as part of a confidential reference.
- The information is used in management forecasts or ongoing restructuring documents.
- The information is related to an ongoing disciplinary or appeal process. We will normally be able to disclose these documents once the appeals process is over.
How much will my request cost?
Requests are normally free of charge. A ‘reasonable fee’ can be charged if the information requested is excessive or unreasonable (as defined in the UK GDPR). We may charge a fee if you ask for copies of the information we have already provided to you.
When will I receive my information?
The University will respond within 30 days from the date your request is received and verified. You will be informed of the deadline for your request in an acknowledgment email or letter, depending on how you make your request to us.
If a request is complex or numerous, this can be extended by a further two months. We will tell you as soon as possible if an extension is required.
Unhappy with our response?
If you are unhappy with the University’s response to your Subject Access Request, please let us know by contacting the Data Protection Officer.
You also have the right to complain to the Information Commissioner’s Office if you are dissatisfied by the University’s response. Please be aware that they may ask you to contact the University in the first instance if you haven’t done so already.
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
https://ico.org.uk/global/contact-us/
Last update: 20 October 2023
Back to: Legal & Governance