Subject access requests (SARs)
You have the right to ask for a copy of the personal information the University holds about you. This is called a Subject Access Request (SAR).
On this page
How to make a Subject Access Request
To help us process your request efficiently, please complete our Subject Access Request form. This is the most effective way to ensure we have all the information we need to process your request.
If you can’t use the form, you can make a request via email or post using the contact details below. Please read the guidance on this page to help you frame your request and ensure that you provide enough information for us to identify the information you are seeking.
Information Compliance Manager
University of Bristol
Beacon House
Queens Road
Bristol
BS8 1QU
Email: data-protection@bristol.ac.uk
There is no fee for making a Subject Access Request.
To keep your personal data secure, we will ask you to provide a valid form of photo ID so we can verify your identity before we process your request.
Getting the Most Out of Your Subject Access Request
Making a Subject Access Request (SAR) is your right, and we're here to help you access the information that's most useful to you. To help us find the information you are looking for, please describe the personal data you would like to access as clearly as possible.
The University is a large organisation, and your personal information may be stored across different systems and departments. Providing a clear and focused request helps us find the information you're looking for more quickly and accurately.
Focus on what you need most
The University does not have one system that can search all of your personal information at the same time. Your information may be held across different departments and systems.
To respond to a Subject Access Request, we may need to:
- Contact different teams across the University.
- Search multiple systems and records.
- Retrieve documents manually.
- Review each document carefully to identify your personal data and remove information that cannot be shared.
If a request asks for "all information" or covers a long period of time, it can result in thousands of documents. Much of this may be routine administrative information, such as long email conversations about meeting arrangements, timetable queries, or automated system notifications, which may not be relevant to what you're looking for.
Reviewing this large volume of information takes time and can delay your response. In some cases, if a request is extremely broad, it may not be possible for the University to process it using reasonable and proportionate efforts, as required under data protection legislation.
Keeping your first request focused does not limit your rights.
Many people choose to request the information most relevant to their concern first. After reviewing the response, you can submit another Subject Access Request if you decide you need additional information.
AI Assistance
Many people use AI tools to help draft emails and requests. While these can be useful, they sometimes produce requests that are much broader than intended or include information about systems or records that the University does not have.
Before submitting your request, it's a good idea to read it through and check that it clearly reflects the information you actually want to receive.
Context
You don't need to explain why you're making a Subject Access Request. However, providing a brief description of the topic or issue you're interested in can help us identify the most relevant information more quickly.
A little extra detail at the start can help us provide a response that is more useful and better meets your needs.
Request for Emails
You have the right to request personal information about you that is contained in emails. To help us locate the relevant emails, please include as much of the following information as possible:
- The names of the people who sent or received the emails.
- The date (or date range) when the emails were sent.
- Any other details that could help us identify the emails, such as a subject, topic, or department.
Providing this information will help us process your request more efficiently. If there is not enough information to identify the records you are requesting, we may be unable to locate the relevant data or fulfil your request.
Information about other people
Sometimes the information you request may also include personal information about other people.
When this happens, the University must balance your right to access your personal information with other people's right to privacy.
To protect the personal information of others, we may:
- Remove or hide (redact) information that identifies other individuals before providing you with your response.
- Edit documents so that only your personal information is disclosed.
- In some cases, ask the other person for their consent to share information that relates to them. If they don’t give consent, we will consider whether it is appropriate to disclose the information without it. This decision is made on a case-by-case basis, taking into account the circumstances and the guidance issued by the Information Commissioner's Office (ICO).
Exemptions
In some circumstances we may need to withhold some or all of the information you have requested. These exemptions are applied on a case-by-case basis and only where permitted under data protection legislation. Where an exemption applies, we will explain our decision where we are legally able to do so. Further information on exemptions can be found on the ICO website.
Timescales
The University will respond to requests within 30 calendar days of receipt of the completed form (provided sufficient information has been given to the University to enable the University to process the request), or, in the case of exam marks, up to five months from the time when the University has sufficient information to process the form.
Retention
Subject access requests will normally be held by the University for three years after the final action.
Complaints
If, on receipt of our response, you consider that the University has not dealt correctly with your request, you may complain via our complaints procedure.
Transcripts and Replacement Certificates
You do not need to put in a Subject Access Request to access transcripts and certificates. These can be requested from Student Administration using these processes:
Guidance for staff
Please see the Information Compliance SharePoint site for guidance on dealing with subject access requests. Further details about subject access requests and other information rights can be found in the Information Rights procedure.