Legal Services


SAR: Exemptions

Confidential Refrences

Confidential references which have be written by an organisation for the purposes of employment, training or for providing a service, are excluded from the rights of subject access under data protection legislation. This exemption only applies to references given, and not to references which have been received by an organisation.

Examination Marks

Students cannot request to see a copy of their examination results before they are officially published. Examination marks are excluded from the normal 40 day timescale. UCL will disclose this information either five months from the day on which the request was received, or 40 days from the announcement of the results, whichever is earlier.

Examination Scripts

Universities do not have to provide copies of examination scripts to candidates. However, the comments recorded by an examiner, are not covered by this exemption, and should be made available to the student upon request from the relevant department.

Management Forecasting or Management Planning

Personal data consisting of records being processed for management forecasting or management planning, the data is exempt from the subject access rights provision. To the extent that those provisions may prejudice the business or other activity of an organisation.


Where personal data consists of records of the intentions of the data controller in relation to any negotiations, with the data subject, such personal data are exempt from the subject information provisions to the extent to which the application of the subject information provisions would likely to prejudice those negotiations.

Third Party Info

There are specific circumstances, envisaged by the data protection legislation, where it is not possible to provide information in its entirety. Some information, for example emails, may contain personal data which relates to third parties. Whilst the University accepts a data subject's rights of access under the data protection legislation it is also necessary to ensure that any third party rights are protected in accordance with the Data Protection Principles.