Data Protection Act 1998The University processes information about its staff, students and other individuals for a variety of purposes. When processing information, the University is committed to protecting the rights and privacy of students, staff and others in compliance with the Data Protection Act 1998 and related legislation.

The Data Protection Policy sets out the principles that apply in meeting this commitment.

Data Subject Access Requests

Staff, students and other data subjects in the University have the right to access personal data that is being kept about them either on computer or in structured and accessible manual files. Any person wishing to exercise this right should submit a request in writing. Please see the DSAR guidance below for further details.


Current and former members of staff should write to the Director of Human Resources and advise the nature and range of the personal data about themselves which they are seeking.  The Director of Human Resources will advise whether further information confirming identity is required and advise how sight of the information is to be made available. 


A student may make an informal request to see information about themselves, and this, where possible, will be dealt with informally by the member of staff approached, having satisfied him/herself as to the enquirer’s identity.  For this reason, requests made by telephone or e-mail may not be acted upon.

If an informal response is not appropriate, a current or former student or current or former member of staff should make a formal Subject Access Request under the Data Protection Act.  Such Requests, which must be made using the Data Subject Access Request (DSAR) Form, should be completed and returned as indicated.

Data Subject Access Requests made on behalf of a student, e.g. by a Solicitor, should always be made on the DSAR form.

The University will make a charge of £10 for each official Subject Access Request under the Act.

The University will aim to comply with requests for access to personal information as quickly as possible, but will ensure that it is provided within 40 days from acceptance of the DSAR Form and receipt of the £10 fee unless there is good reason for delay.  In such cases, the reason for the delay will be explained in writing by the Data Protection Officer to the data subject making the request.

If you have any queries about this process or any queries relating to data protection, please contact the Data Protection Officer.