Subject Access Request
Subject Access Request
Under Data Protection legislation, an individual has the right to ask an organisation for access to and copies of personal data held about them.
This is the Right of Access, more commonly known as a Subject Access Request (SAR)
The following applies to SARs:
- individuals may only request information about themselves.
- proof of identity from the individual is required (photographic ID such as a passport, drivers licence, student card etc.).
- a third-party, such as a lawyer, may submit a SAR on behalf of an individual, subject to their written consent.
- there is a one month response timescale for SARs, however this can be extended to three months in certain circumstances (e.g. where the request is complex).
The University is only obliged to perform reasonable and proportionate searches to fulfil a SAR. This does not extend to collating and reviewing metadata for individual records or audit logs containing personal data. The Information Commissioner’s Office (ICO) have advised that the University is not required to conduct searches that would be unreasonable or disproportionate to the importance of providing access to information sought by an indivdual under their Right of Access.