Subject Access Requests
You have a right to see what personal information we hold about you and to be provided with the information within a calendar month from receipt of your request. If the information we hold about you includes information about anyone else (a third party), we may redact this information first.
We will also need to verify your identity before we can share any information with you.
How to make a Subject Access Request
So we can verify your identity, we require your request in writing (this includes email), together with evidence of your identity. We ask to see photo ID, such as your passport or photo driving licence. If you don’t have either of these, we will ask you for other evidence to verify your identity. We will also ask for evidence of your address (such as a utility bill and Council tax bill), and we may ask you for further details so that we can locate the requested information.
Requests can be accepted from someone acting on your behalf (including from a solicitor) as long as we have evidence of your consent for them to act on your behalf and we can verify your identity as described above.
Information requests from parents and guardians
Normally, DMU is unable to disclose information about students to parents or guardians without the student's explicit consent. If you request information about your child, DMU will check whether the student consents to us releasing information to you, but we will otherwise not comment, including whether they attend DMU.
The Information Governance Manager is responsible for responding to requests for personal information.
Email: firstname.lastname@example.org or write to:
Information Governance Manager
Heritage House 2.11
De Montfort University
Please tell us what information you are requesting as clearly as possible. If we are unable to determine from your request what information you want to see, or if we need additional information from you so that we can comply with your request, we will contact you as soon as possible to advise you of this. The time for compliance will stop until we receive a response.
Where information may not be supplied under a SAR
DMU may not release all the information requested where disclosure could present a risk of harm to the data subject or another person, or if disclosure may impact on any criminal investigation or could lead to the carrying out of a crime. We will assess the level of risk where applicable.
Where the information requested contains data relating to third parties, we will seek to disclose the maximum information permitted by law. Where third party information is redacted, the reasons for the redaction will be shared with the requester unless this would lead to their identification by the data subject.
Requests for Review
If you are unhappy with the response you have received, you should first request an internal review. This review will normally be carried out by our Data Protection Officer.
If you are dissatisfied with the outcome of the internal review, you have a right to complain to the Information Commissioner’s Office (ICO) at:
Information Commissioner’s Office
Cheshire SK9 5AF
For more information about complaints and your rights, please see the website of the Information Commissioner.