Request personal data

Source: https://www.leeds.ac.uk/information-data-requests/doc/request-personal-data Parent: https://www.leeds.ac.uk/freedom-of-information

Under the General Data Protection Regulation and the Data Protection Act 2018, you have the right to access the personal data which the University holds about you, subject to certain exemptions.

Requests for access to personal data are known as Data Subject Access Requests (DSAR). This page explains how to submit a DSAR to the University, how we will handle your request, and your right to complain if you are dissatisfied.

How to submit a request

The easiest way to make a request is to complete our Data Subject Access Request (DSAR) form (Word). This provides us with the basic information we need to begin to process your request. If we require any further details or clarification, we will contact you to discuss.

If you do not wish to use this form, you can also email your request to the Information Governance team at dsar@leeds.ac.uk. The Information Commissioners Office (ICO) produces guidance on how to request your personal information from a public authority.

When making your request please be as specific as possible about the Personal Data which you want access to, as this will assist us in processing your request. For example, if you only want Personal Data relating to your involvement with a specific team, you should indicate that. A general request for all data, for example, is likely to lead us to contact you for further information or clarification.

You will need to provide proof of ID to ensure that we are releasing personal data to the correct person. Please supply a photocopy, scanned copy or photo (not the original) of one of the following:

• Your student or staff ID.
• Your passport.
• Your driving licence.

Send your information request and copy of your ID to the Information Governance team email: dsar@leeds.ac.uk

What happens after my request is submitted

We will send you an acknowledgement of your request as soon as possible.

We will respond to your request as soon as possible, and within one month of receipt of your request (unless we have grounds to extend that timescale). If we reasonably require further information from you to locate the personal data which you have requested, we will inform you as soon as possible.

We will provide the personal data in a commonly used electronic form. Where you have made a request by post, we will normally send the personal data on paper to the postal address specified by you, unless we agree with you that the personal data can be supplied in a different format. The personal data may take the form of photocopies, printouts, transcripts or extracts, or a combination of these, depending on what is most appropriate in the circumstances.

Restrictions on information we can provide

The law includes exemptions to the data we can release in response to a DSAR. These include, but are not limited to, the following:

• Third party personal data, which can be any information that could potentially identify someone else, such as their name, or things they have said. We will redact or remove all information that is not relevant to the person making the request, or which is third party personal data.
• Legal professional privilege, which means we can’t provide personal data about you if it is part of legal advice received from a solicitor to the University.
• Management forecasts, which can apply if the University is making decisions about its future, but it hasn’t yet finalised these or communicated them to members of staff, for example, if the University is planning a restructure or a round of redundancies.
• Negotiations, which can apply when there are ongoing negotiations between the University and the person making the request, and to provide this information would prejudice these.
• Confidential references, which can apply to any confidential references which have been given or received by the organisation. This is only applicable if the reference was made in confidence and it is not a blanket exemption.
• Exam scripts and exam marks, which means you can’t request copies of your answers to exam questions. However, we can release the information recorded by the person marking the exam (such as comments and scores).

How do I complain?

If you are dissatisfied with the response to a data subject access request, you can email the Information Governance Team at dsar@leeds.ac.uk.

To progress your appeal as quickly as possible, please quote your request reference number and the date of your original request, as well as details of why you are making the appeal.

Following the review, you will be provided with a report containing the outcome and subsequent actions taken by the University.

If you are not satisfied with the outcome of the appeal, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office\ Wycliffe House\ Water Lane\ Wilmslow\ Cheshire\ SK9 5AF.

Further information about how to enforce your rights under applicable data protection laws is available on the Information Commissioner's website.