Data Protection: Subject Access Requests

Under the Data Protection Act 1998, individuals are entitled to request access to the personal data that the University holds about them. The procedure below describes the process for making a 'Subject Access Request'.    

Subject Access Requests must be made in writing and provide reasonable information to enable the University to identify and locate the information sought. A Subject Access Request form (PDF , 25kb) is available to download. The form is designed to assist applicants with the process, however its use is not obligatory. A request must be accompanied by sufficient proof of your identity (to ensure that your information is only disclosed to you) and there is a standard subject access fee of £10. Cheques should be made payable to the 'University of York'. Further details and a checklist are also available as part of the subject access form.     

All requests will be dealt with promptly and no later than forty days following the receipt of the request or, if later, following receipt of the fee and the necessary information to confirm your identity. The information provided in reply to a request will be that which the University holds (subject to any exemptions) at the time the request is received, aside from any routine updating and maintenance of the data.

Records may sometimes contain the details of third parties to whom the University owes a duty of confidence or privacy. Individuals are only entitled to access the data of which they are the subject: references to third parties will normally be deleted before disclosure. The University may contact third parties (e.g. referees, authors of e-mails/letters) when considering an individual's right to access and any duty of confidence owed to a third party, to obtain their views on disclosure. Where this is impossible and consent from the third party has not been received information may not be disclosed.     

Your written request or form, complete with payment and identification, and any further enquiries should be sent to: