Subject Access Request
Data Protection Act 1998 (DPA) came into force in 2000. It gives individuals
(data subjects) a number of rights including the right to their personal data
which an organisation holds on them. Under section 7 of the DPA, data subjects
have a right of access to any personal data held by a data controller (in this
- What does it cost?
UCL does not charge a fee for subject access requests.
- How do I submit a subject access request?
To assist the University in complying with the statutory timescales we will require such requests to made in writing and accompanied by formal identification.
If you wish to submit a request, you should do so by completing the form below:
This form will provide the university with the necessary information needed to deal with your request and should be sent by email to firstname.lastname@example.org.
- What information can be disclosed?
The right of access extends to all information held on an individual, and includes staff files, student record files, databases, interview notes and e-mails referring to the individual.
- Are there any exemptions to the subject access request right provisions?
There are a number of exemptions within the DPA which effectively allow information to be withheld, some of these are summarised below:
- What is the time limit for compliance?
The data controller is required to communicate to the data subject the information it holds in an intelligible form within 40 calendar days, starting from the date the request is received by the data controller, or the date on which the prescribed fee, or has been provided with sufficient information by the data subject to locate the information being requested.
- Guidance for Staff on the handling of subject access requests
- Guidance for data protection coordinators on the handling of subject access requests
Please remember that it is a legal requirement that UCL responds to requests within 40 calendar days, DO NOT delay requests for information.