Make a Subject Access Request

You have the right to ask the University whether or not we are using or storing your personal information and ask for copies of your personal information. This is called the Right of access and is commonly known as making a Subject Access Request or SAR.

You can make a Subject Access Request to find out:

  • What personal information we hold about you.
  • How we are using it.
  • Who we are sharing it with; and
  • Where we got your data from.

Your right of access does not entitle you to receive full copies of original documents or emails – only the personal information contained in them. You are only entitled to information about you – not any document or email that simply mentions you.

Information that is not your personal data will not be provided or could appear blacked out within a document. There may be other reasons why you may not receive all the information you expect, such as when an exemption applies, or the type of information you asked for is not covered by a subject access request. We will tell you if this is the case.

We may refuse your request if we decide it is manifestly excessive or unfounded. This includes requests for information that you have already been given or requests that are malicious in intent.

The easiest way to make a request is to complete our Subject Access Request form (Word).  This gives us all the information we need to identify you and search for the personal data we hold. If you do not wish to use the form above, requests can also be emailed directly to legal@liverpool.ac.uk. You can make a subject access request verbally, but we recommend you put it in writing if possible because this gives you a record of your request. The Information Commissioners Office (ICO) produces guidance on how to request your personal information from a public authority.

ID (identity) checks are required for security – to protect your personal data from unauthorised access. Examples include a photo driving licence, passport page, birth certificate, a university staff or student card, or any other internationally recognised ID card.

You can authorise someone else to make a Subject Access Request for you. If you are making a request on behalf of someone else, we need evidence of their identity and written consent or proof of legal authority.

Send your completed form and evidence of identity by:

  • Email to legal@liverpool.ac.uk
  • Post to Data Protection Officer, Legal & Governance, University of Liverpool, Hart Building, Mount Pleasant, Liverpool L3 5TQ. 

Requests are usually free of charge. We may charge a fee if you ask for copies of information that we have already provided to you.

The University will respond within 30 days from the date your request is received and verified. We will tell you the response date in your acknowledgment email or letter (depending on how you made your request).

If a request is complex, it can be extended by two months. We will tell you if an extension is needed.

If you are unhappy with our response to your Subject Access Request, you can ask the University to review it.  If you remain dissatisfied after the review, you can appeal to the Information Commissioner. See http://ico.org.uk/complaints. An appeal is free of charge. 

We will keep records of our correspondence with you. We do this to meet our legal obligations, to check compliance, and to monitor demand. See our Information Compliance Privacy Notice.

Page updated: 15 January 2025

Back to: Legal & Governance