Please read our student and staff community guidance on COVID-19
Skip to main content Skip to navigation

Subject Access Requests

What is a Subject Access Request?

Under the Data Protection Legislation, individuals are able to make requests to organisations such as the University for confirmation that it is processing their personal data. If we are holding any of your personal data we will be processing it.

You are entitled to a copy of your personal data and certain supplementary information. This is called a "subject access request".

The General Data Protection Regulation ('GDPR') gives the following definition of personal data:

“Personal data means any information relating to an identified or identifiable natural (a living individual) person (‘data subject’).”

It goes on to say that an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

The supplementary information that you are entitled to is:

  • An explanation of why we are (the purposes) processing your personal data;
  • the categories of personal data we are processing;
  • the recipients or categories of recipient to whom your personal data have been or will be disclosed, in particular any recipients in third countries (outside the EEA) or international organisations;
  • where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the University rectification or erasure of your personal data or restriction of our processing of your personal data or to object to such processing;
  • the right to lodge a complaint with the Information Commissioner Office;
  • where your personal data was not collected directly from you, any available information as to its source;
  • the existence of any automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
  • Where your personal data is transferred to a third country or to an international organisation, you have the right to be informed of how the University ensures its safety.

You may find it helpful to read the guidance from the Information Commissioner's Office on how to request your personal information.

How Do I Make a Subject Access Request?

To help us faciliate your Subject Access Request, it would be helpful (it is not obligatory) if you could complete a Data Subject Rights Form, providing as much information as possible, and submit this by email to infocompliance at warwick dot ac dot uk or send it to:

Information and Data Compliance
University House
University of Warwick

In addition you will need to send a copy of your ID such as a passport, driving license, birth certificate or other internationally recognised ID card. The University will not release personal data to you unless fully satisfied as to your identity.

Download a Data Subject Rights form here:

Or complete our online Data Subject Rights form

Please be aware that in some cases specific procedures are in place for allowing access to particular types of information, such as access to copies of Student Transcripts. In these cases please follow the existing procedures.

How can I get the most out of my subject access request?

You are advised to make your request for information as specific as possible to include, details of dates, type of information (eg memos, letters, reports, emails etc), department and the names of authors and recipients, where appropriate. If you know which departments in the University hold information on you, please state this on your application. If you are requesting correspondence, it will help greatly if you can let us know who the correspondence will be from and during which time period.

The University reserves the right to seek additional information from the you before processing the request.

What are the timeframes for my subject access request?

The statutory period for requests to be fulfilled is one month, however the University can extend this by up to a further two months depending upon the complexity and number of requests that you make. If the University does propose to extend the one month time period we will let you know (within that first month) why and tell you when your request will be answered.

How will I receive my information?

If you make a request by email then we will reply by email unless you ask for it in another format, i.e. paper, which you can collect from us.

What should I do if I am unhappy with the response I receive?

If you have concerns about the response you have received, or are unhappy with the response, you should contact the Information and Data Compliance team in the first instance, via infocompliance at warwick dot ac dot uk. If you have reason to believe that there are specific documents missing from your disclosure, it will help us investigate if you can list them or provide us with more information about the location of those documents.

Please note that some historic data may no longer be held due to our ordinary data retention policies.

If you are submitting a subject access request relating to an ongoing appeals process, or another kind of ongoing review, some of this data may be considered exempt from disclosure. If this is data that you have directly requested, we will ordinarily inform you that we have considered that particular document exempt from disclosure. We will normally be able to disclose these documents once the appeals process is over.

If you are still unhappy with the response you have received, you may go through the University complaints procedure. You may also contact the Information Commissioner's Office and ask them to look into matters.