Subject Access

The guidance below is for data subjects who wish to obtain access to their personal data; it will help you to understand your rights and make the most of your Subject Access Request.

How can I make a subject access request (SAR)?

Current staff/students: If you are looking for a specific document, or a small amount of simple data (which does not contain personal data about other people in addition to yourself), such as a letter from Occupational Health, or your Exceptional Factors form, you should contact the relevant University team in the first instance to request this.  In these instances, you should not expect to receive a formal written response to your request; the University’s primary aim is to facilitate access to your data, where appropriate.

For all other individuals, and staff/students who require more complex data: (eg held by a number of staff or across several University departments; or likely to contain personal data regarding other individuals, in addition to yourself), please contact the Data Protection Team in Legal Services at: dataprotection@mmu.ac.uk or tel: 0161 247 3401.

You can make a subject access request verbally or in writing (electonically or by post); although written requests are preferred (especially for larger volumes or complex data), so that we can be sure the request is clear and we can identify all the data you require.  You're not required to complete a form (and we are currently reviewing our SAR forms). 

 

Do I have to pay a fee?

In most cases, we won't charge a fee.  However, the legislation allows us to charge a fee in certain circumstances, eg, if you require duplicate copies, or if a request is considered to be manifestly unfounded or excessive.  If a fee is applicable, we will let you know in advance and give you the option to withdraw your request without incurring any charge.

Do I have to provide anything else?

We may need to check your identity: when we receive your request / prior to releasing the information:   ID verification checks will depend on whether you are a current student or member of staff, and how you communicate/submit your request.  Eg, if your contact details don't match those we hold on file for you, we will need further evidence of your identity, such as a copy of your passport/driving licence and a utility bill confirming your address.  You may therefore prefer to use your MMU email address or a postal address that matches our records. 

If you attend in person to request or collect copies of personal data, be prepared to show your University ID card. 

 

We may need to ask you for clarification, or for more information to help us identify your personal data:  The University processes large amounts of data as we have a high number of students, staff, applicants, enquirers, graduates, alumni and other contacts. If your request is broad or vague, we are entitled to ask you for more information to clarify your request to enable us to identify the data. 

If we ask you for clarification, the timescales for complying with your request will not commence until we receive this additional information from you.

When will I receive the data I have asked for?

There are 2 timescales for responding to SARs, depending on the nature of your request: 

  • The standard timescale is one month. 
  • If your request is complex, involves a high volume of data, or if we receive a number of requests from you, we may extend the timescale by a further two months (to a maximum of 3 months in total). 

We will let you know within one month of receiving your request if we need to extend the timescale and explain why.  

If we need to ask you for clarification or more information because your request is broad or vague, or we cannot identify the information you are seeking, the timescale will not commence until we receive this information from you.

Generally, the broader your request, or the more information you ask for, the longer it is likely to take.   For example, emails are often unstructured, informal, and contain complex third party personal data; it is likely to take much longer to process email data than it would to provide a copy of your staff/student file.  We must also take into account the number of requests the University is dealing with at the time; it is not possible to prioritise one individual’s request above others, although requests which are limited in scope, clear and focussed are likely to be processed more quickly.

You should not expect to wait any longer than one month for simple, low volume requests; or three months for higher volume and complex requests.

Can someone else make a SAR on my behalf?

You may provide permission for a solicitor or other individual to submit a subject access request on your behalf.  However, we may need to contact you directly about the request to conduct identity checks or ensure adequate consent is obtained.  Solicitors may provide a signed form of authority, confirming that you have given your consent for the University to release your data to the solicitor.  

What information am I entitled to?

There are exemptions from the right of access under the GDPR and Data Protection Act 2018.  If an exemption applies to data you have requested, we will notify and explain this to you.   

The right of access applies to data held by the University at the time of your request: please be aware that the University will routinely destroy information in accordance with its Records Retention Schedule; and we are unable to recreate or provide information which was previously held but has since been routinely destroyed.

Under the Right of Access, you are also entitled to receive additional supplementary information about the University’s data processing activities.  We provide this information in the following documents:  

Can I obtain copies of emails?

Yes, you may request copies of emails held by the University containing personal data relating to you. However, please note that: 

- email is not a data storage facility but a communication tool.  Emails are often informal and contain information about other individuals with the same/similar name, or information about more than one individual.

- we cannot conduct a central University-wide computerised search for all personal data relating to one person; the system is too large, data is too complex, and no computer system can identify personal data.

- the process for identifying and providing personal data held in emails requires: individual searches of specified email accounts, a manual review of all data retrieved to identify personal data, the removal of duplicate copies, and the removal/redaction of exempt information such as third party personal data.   Email searches often result in large volumes of complex data, containing personal data information about more than one person.  Depending upon the volume & complexity of the data involved, a request for email data may result in an extended timescale for responding to your SAR; or increase the likelihood that the University may refuse your request as manifestly unfounded or excessive.

- unless you specifically request otherwise, we will not usually provide copies of emails containing your name in the To/From/Cc fields of an email, as we assume that you already have access to this data (having sent/received it previously from your own account).  However, if you do wish to request duplicate copies of emails you have deleted/mislaid, please let us know. 

To enable us to identify emails containing personal data relating to you, we will ask you to provide the following information with your request:

  • Names of the accounts likely to hold relevant personal data relating to you, or the sender/recipients of the emails 
  • Dates (or date ranges) of the emails you require, eg from 1st January to 31st March 2018.
  • Any other relevant information that might assist the University to locate the specific information you require.

Will you refuse to provide any information?

The University has the right to charge a fee, or refuse any request, which is manifestly unfounded or excessive, or repetitive.  If this applies to your request, we will contact you within one month of receiving your request to let you know.

There are also some exemptions to the right of subject access (such as personal data relating to another person) which means that the University may need to withhold or remove certain types of information from the documents we disclose to you.  If an exemption applies to your request we will let you know. 

Can I ask for paper / electronic copies?

The University can supply copies of data electronically (by email/secure portal) or in paper/hard copy format, which you can choose to collect in person or receive by post (recorded delivery). 

If you contact us by email we will usually provide the information electronically, unless you specify otherwise. 

 

What if I am dissatisfied with the outcome of my SAR?

Please remember that the purpose of the Right of Access/SAR under GDPR is to allow you, as data subject, “to be aware of, and verify, the lawfulness of the processing” by the University.  Because SARs are designed for this specific purpose only, you may be disappointed in the outcome if you are asking for information for any purpose other than: checking and verifying that the University is processing your data lawfully.

However, if you are dissatisfied with the handling/outcome of your request, and wish to make a complaint, please submit your reasons in writing to the Data Protection Officer at: dataprotection@mmu.ac.uk  Your complaint will be investigated and you will receive a response to your complaint within one month of receipt. 

If you remain dissatisfied with the outcome of your complaint, you have a subsequent right to make a complaint to the ICO, or to seek to enforce your rights under GDPR through a judicial remedy.  See the ICO website for more information: https://ico.org.uk/

Subject Access