Skip to main content
Subject Access Request – Bath Spa University

Subject access request

Individuals can request personal information held by the University.

Bath Spa University is committed to the security of your personal data, and to enabling your rights under the Data Protection Act 2018, GDPR, and associated data protection law. Under the Data Protection Act and in line with data subject rights, individuals have the right to know what personal data about them is being held by the University. 

Requests made by individuals to access their data are known as a Subject Access Request. (Subject Access Requests are different to requests submitted for information under the Freedom of Information act, which relate to information about the university itself).  

Further information on how Bath Spa University processes your personal data is available in our privacy policies.

Subject Access Requests can be made by contacting the University at with details of your identity and relationship to the University, and of the information you are requesting.


What is a Subject Access Request?

Under the Data Protection Act, individuals have the right to know what personal data about them is being held by the University and to access that data. Requests made by individuals to access their data are known as Subject Access Requests (SAR).

What is personal data?

Personal data is defined as information relating to a living individual that enables that individual to be identified from the data.

Personal data may contain “special categories of data” such as your racial or ethnic origin, religious beliefs or other beliefs, physical or mental health or, in relation to DPA only, other conditions and information concerning any criminal offences or criminal proceedings.

What sort of information can I request?

Individuals have the right to obtain a copy of their personal data as well as other supplementary information. Personal data can include (but is not limited to): 

  • Staff files 
  • Student record files 
  • Databases
  • Interview notes
  • Email correspondence
  • Disciplinary reviews 
  • Complaint records
Do I have to pay to make a Subject Access Request?

Bath Spa University does not charge a fee for Subject Access Requests.

Can I make a request on behalf of someone?

You are able to make a request on behalf of the data subject so long as you provide copies of the following when submitting the request through the online form:

  • Written signed authority of the subject 
  • Proof of identity of the subject 
  • Proof of identity of the requester
How long will it take?

We aim to fulfil your request without undue delay or at the latest within one calendar month of receipt of all information necessary to conduct your request. If we process a large amount of information we may extend the time-frame to allow sufficient due diligence. We will ensure to keep you informed if we feel it is necessary to extend your request.

What if my request contains personal data about others (third parties)?

Some information may contain personal data relating to others (third parties). The request may lead to a conflict between the data subject's rights of access and the third party's right to confidentiality.

In responding to subject access requests the University will need to ensure that the rights of those third parties are not compromised by releasing the information. Where necessary, redaction may be used so that the third party information does not form part of the requested information.

Who do I contact if I have questions or concerns?

You can contact the Data Protection Officer via the Compliance team on

Edit section | Website feedback to