Requests for Personal Information

Data Protection Act 1998 (DPA)

Where an applicant makes a request for his or her own personal data, the data is absolutely exempt and the request will be treated as a subject access request under the DPA.

If the information requested includes personal information about a third party, the information will be provided, unless:

1 Disclosure would contravene any of the data protection principles. The key issues in this regard are fairness and lawfulness, and these will be considered fully before disclosure is made.

2 Disclosure would contravene Section 10 of the Data Protection Act (right to prevent processing likely to cause damage or distress).

3 The data subject would not be entitled to receive the data.

4 Disclosure would contravene UCL’s notification to the Information Commissioner under Section 17 of the Data Protection Act.

Subject Access Request

The DPA gives individuals (data subjects) a number of rights including the right to access personal data organisations hold about them. Section 7 of the Act, gives a data subject a right of access to any personal information held by a data controller (in this case UCL). The right of access extends to all information held on an individual, including personnel files, student record files, databases, interview notes and e-mails referring to the individual. This is known as a Subject Access Request.

The data controller has to communicate to the data subject the information held in in an intelligible form within forty days, and can charge £10 for doing so.

The request must be in writing or by completing form 6 which is available together with further information from Legal Services.

You will be required to provide enough information to prove your identity. You may also be required to provide us with appropriate information to help the University locate the information you require.

Exempted Information

As with the FOI Act, the DPA is subject to a number of exemptions. These include, confidential references provided by UCL, examination scripts and research data. If an exemption applies to the information you have requested you will be informed in writing.


If you are unhappy with the Universities' handling of your subject access request and you wish to make a complaint you should do so in writing, quoting the relevant reference number, to the following address:

Complaints should be addressed to:

Mr. Alex Daybank

Data Protection Officer

Legal Services

Finance and Business Affairs

6th Floor, 1-19 Torrington Place

London WC1E 7HB

If you remain dissatisfied, you should contact the Information Commissioner's Office at the address below for advice.

Information Commissioner's Office address

Wycliffe House

Water Lane



Telephone 01625 545700

Page last modified on 04 jan 16 12:05