{"id":102,"date":"2026-07-17T13:46:27","date_gmt":"2026-07-17T12:46:27","guid":{"rendered":"https:\/\/blogs.bath.ac.uk\/data-and-information-management\/?p=102"},"modified":"2026-07-17T11:47:56","modified_gmt":"2026-07-17T10:47:56","slug":"subject-access-requests","status":"publish","type":"post","link":"https:\/\/blogs.bath.ac.uk\/data-and-information-management\/2026\/07\/17\/subject-access-requests\/","title":{"rendered":"Subject Access Requests: What To Do and Why You Should Care"},"content":{"rendered":"

Imagine\u00a0you\u2019ve\u00a0been promoted.\u00a0You\u2019re\u00a0ecstatic on your first week of your new job\u00a0and nothing can bring you down.\u00a0<\/span>\u00a0<\/span><\/p>\n

You get an email from a\u00a0former colleague, someone that was passed over for this promotion\u00a0before\u00a0bitterly\u00a0moving\u00a0to a new job. They ask to see all the emails and Teams messages\u00a0where\u00a0you\u2019ve\u00a0talked about them\u00a0behind their back. Fat chance\u00a0I\u2019m\u00a0sending them that, you think before\u00a0closing the email.<\/span>\u00a0<\/span><\/p>\n

What you\u00a0haven\u2019t\u00a0realised is that\u00a0the email\u00a0may\u00a0constitute\u00a0a Subject Access Request\u00a0and, if so,\u00a0a clock has started\u00a0ticking.\u00a0Ignoring\u00a0such an\u00a0email\u00a0could\u00a0mean\u00a0the University\u00a0fails\u00a0its legal obligations.\u00a0<\/span>\u00a0<\/span><\/p>\n

Subject Access Requests<\/span><\/a>\u00a0(SARs)\u00a0are\u00a0a\u00a0right under UK GDPR,\u00a0and\u00a0a request that does not mention\u00a0\u201cSubject Access\u201d,\u00a0\u201cSAR\u201d\u00a0or\u00a0\u201cdata\u201d\u00a0can\u00a0still be valid.\u00a0They grant\u00a0individuals\u00a0the ability\u00a0to\u00a0view\u00a0Personal Data that\u00a0an organisation\u00a0holds on them,\u00a0subject to\u00a0limitations and exemptions,\u00a0especially where\u00a0their\u00a0request clashes with the rights of others.<\/span>\u00a0<\/span><\/p>\n

So, what should\u00a0you\u00a0have done?<\/span>\u00a0<\/span><\/h2>\n

If you are asked to\u00a0give someone access to their Personal Data,\u00a0beyond any routine request, you must\u00a0immediately\u00a0forward the\u00a0entire\u00a0request\u00a0to the\u00a0<\/span>Data Protection\u00a0team<\/span><\/a>.\u00a0<\/span>\u00a0<\/span><\/p>\n

This is true\u00a0regardless of\u00a0what the request is for\u00a0and how it is delivered. It\u00a0doesn\u2019t\u00a0matter if the request is for CCTV\u00a0or\u00a0attendance\u00a0records, whether\u00a0it\u2019s\u00a0been\u00a0delivered verbally, by pigeon\u00a0or\u00a0by Instagram direct message, you must\u00a0contact\u00a0<\/span>dataprotection@bath.ac.uk<\/span><\/a>\u00a0<\/span><\/p>\n

Don\u2019t\u00a0hesitate\u00a0since\u00a0the University has a\u00a0responsibility to\u00a0fulfil a SAR\u00a0without undue delay,\u00a0generally within\u00a0one calendar month\u00a0from the moment a request is\u00a0submitted.<\/span>\u00a0<\/span><\/p>\n

What will be checked?<\/span>\u00a0<\/span><\/h2>\n

Depending on\u00a0what Personal Data is requested\u00a0and what is reasonable and proportionate,\u00a0Teams messages, emails, documents, or CCTV footage may\u00a0all\u00a0be checked. However, this does not mean full documents\u00a0will be shared,\u00a0people are only entitled to their data\u00a0with other Personal Data redacted.<\/span>\u00a0<\/span><\/p>\n

While personal devices and external platforms such as WhatsApp will not be checked by the Data Protection team,\u00a0work data on such devices\u00a0<\/span>are<\/span><\/i>\u00a0in the scope of a SAR and using\u00a0these\u00a0to\u00a0deliberately\u00a0conceal data from SARs\u00a0could\u00a0constitute\u00a0a criminal offence.\u00a0<\/span>\u00a0<\/span><\/p>\n

If you are concerned about a specific SAR or are considering putting in a request yourself,\u00a0please\u00a0schedule a confidential call\u00a0with the\u00a0<\/span>Data Protection team<\/span><\/a>.<\/span>\u00a0<\/span><\/p>\n

If the Data Protection\u00a0team\u00a0contacts\u00a0you<\/span>\u00a0<\/span><\/h2>\n

Even if\u00a0you did not directly\u00a0receive\u00a0the SAR,\u00a0the\u00a0Data Protection team\u00a0may contact you to ask for\u00a0an\u00a0individual\u2019s\u00a0Personal\u00a0Data,\u00a0and you\u00a0<\/span>must\u00a0<\/span><\/b>supply\u00a0everything necessary.<\/span>\u00a0<\/span><\/p>\n

It\u00a0doesn\u2019t\u00a0matter if the\u00a0messages or documents\u00a0are\u00a0embarrassing\u00a0or\u00a0easily misinterpreted,\u00a0it must\u00a0ALL\u00a0be provided\u00a0as\u00a0only the Data Protection team is authorised to\u00a0decide if legal exemptions apply.\u00a0If\u00a0you spot mistakes in the\u00a0data,\u00a0you can correct this\u00a0as long as\u00a0you provide a copy of both the incorrect and the corrected data.\u00a0<\/span>\u00a0<\/span><\/p>\n

Combing\u00a0through\u00a0emails or documents\u00a0may\u00a0be\u00a0extremely time consuming and complex,\u00a0but\u00a0people\u00a0don\u2019t\u00a0submit\u00a0SARs\u00a0for\u00a0fun.\u00a0They\u00a0may need this data for a visa application,\u00a0to show their parents that they\u00a0have been studying,\u00a0or\u00a0simply to\u00a0give them the assurances that the University processed their data fairly and\u00a0lawfully;\u00a0you just don\u2019t know\u00a0how important this could be to someone.<\/span>\u00a0<\/span><\/p>\n

Too long,\u00a0didn\u2019t\u00a0read<\/span>\u00a0<\/span><\/h2>\n