Records Management

Subject access request procedures

Data protection law gives people the right to see personal information which the University holds about them. They exercise this right by making a subject access request.

What is a subject access request?

A request can be very broad such as, ‘give me a copy of all the information you hold about me’, or it can be very precise, such as ‘give me a copy of the letter you wrote about me yesterday’.

Preferably a subject access request should be in writing (including by email or social media), so that it is clear what information is being requested.  Therefore if someone makes a subject access request by telephone or in person you should encourage them to put it in writing.  However, if the person does not want to do this or is unable to, make a record of the verbal request and include it in your acknowledgement.

What to do with a subject access request

If you have no reservations whatsoever about giving out the information which has been requested, are confident of the identity of the requestor, and it is within your remit to do so, then give it out.

You must do this within one month of receiving a valid subject access request.

When providing information you should ensure you use an appropriate level of security. For example if information is being sent to an email address outside of the University it should normally be encrypted.

Requests for copies of Board of Examiners minutes

If you are asked for a copy of minutes of a Board of Examiners meeting, we have specific guidance here to help you.

Requests for copies of Board of Examiners minutes

Requests for copies of references

If you are asked for a copy of references received or provided by the University, we have specific guidance here to help you.

Requests for copies of references

Contact your information practitioner

If you have concerns about giving out the information contact your information practitioner for advice. Situations that may give you concern include: if the University is in dispute with the person making the request or if the requested information includes personal data about a third party.

If some of the requested information is held in other business areas, forward the request to your local information practitioner

Who is my information practitioner?

More guidance

More detailed guidance for information practitioners and other staff involved in subject access requests is available on our wiki. 

Subject Access Requests - Information Request Handling - Wiki Service (ed.ac.uk)