Legal Services


Subject Access Request


The Data Protection Act 1998 (DPA) came into force in 2000. It gives individuals (data subjects) a number of rights including the right to their personal data which an organisation holds on them. Under section 7 of the DPA, data subjects have a right of access to any personal data held by a data controller (in this case UCL).

What does it cost?
How do I submit a subject access request?
What information can be disclosed?
Are there any exemptions to the subject access request right provisions?
What is the time limit for compliance?

Other guidance

Please remember that it is a legal requirement that UCL responds to requests within 40 calendar days, DO NOT delay requests for information.