Data Subject Access Requests (DSARs) help individuals to understand how and why organisations are using their data, and check they are doing it lawfully. For this information please see the KCL privacy notices.

There are a number of exemptions from the right of access and a DSAR may not be the best process for individuals to achieve the resolution they seek.

You do not need to submit a DSAR for student admissions or staff recruitment feedback:

• Student applicants should contact Admissions using the King's Apply Portal  for interview feedback
• If you have made an application to work at King's, please speak to the King's Recruitment Team directly about obtaining feedback.

DSARS entitle data subjects to personal data (data which is about you) but not the data of third parties. Where data could be said to relate to multiple parties and there is no way to anonymise those third parties, the rights to access are weighed up against the other parties right to privacy.

In processes where there is a high expectation of confidentiality and potentially very sensitive information, this balancing exercise will take into account any harm that might occur as a result of disclosure (e.g. what the impact would be on all parties if the data would be withheld, what the impact would be on all parties if the data were disclosed) and those parties reasonable expectations of confidentiality. This is done by line by line analysis and ongoing consultation with the data subjects and information holders. In complex and/or voluminous cases this involves months of work.

This balancing exercise is not an exact science and is dependent on the individual performing the redaction and their knowledge of the wider context. This can mean a data subject will receive less information under a DSAR disclosure than, for example, a HR evidence pack disclosure. If you have raised a grievance, or are party to a grievance, you will receive the relevant documentation as part of the HR grievance process so it is recommended that you await the outcome of the grievance to obtain the information you are seeking.

Before recommending an individual submit a DSAR staff must make sure they check with Information Compliance Team first to see whether a DSAR is the correct process and will actually benefit the individual. Individuals can then be directed to the right process to resolve their issue, ensuring they receive the best possible service from the University and supporting student and staff success. For example, it may be more helpful for students to seek support from their Faculty or the Student Complaints and Misconduct Team or for staff to speak to their line manager or HR. Staff members should note that, if they have raised a grievance, or are party to a grievance, they will receive the relevant documentation as part of the grievance process and may therefore find that the information they are seeking becomes available to them in the course of that process, or at its conclusion.

King's staff can find more about their responsibilities and DSAR procedures on our intranet pages. 

Requests for your personal information or Data Subject Access Requests (DSARs) must be made in writing. Please complete the Personal Information Request Form which you can find below and submit via email or to our postal address.

Please contact us for further guidance.

• Identification: a copy of your passport or driving licence or an original bank statement or utility bill. Current members of staff and current students can also provide a copy of their King's ID card.

• A clear explanation of the information or data you require. The Information Commissioner's Office (ICO) have produced guidance on requesting personal data which may assist you.

  Specifically, the ICO recommend you include the following information in a DSAR:

   
  • a subject line or header that says "subject access request";
  • the date you’re making the request;
  • your name (and any other names where relevant, eg your name before you were married);
  • your email address, home address and phone number;
  • customer account numbers, NHS number, employee number, product number or similar information that can help identify you;
  • what personal information you want (be specific about the information you’re asking for, and where relevant say what information you don’t need);
  • details or dates that will help the organisation find the information you want;
  • the reason you want the information (you don't have to include this but it will help the organisation find what you need); and
  • how you would like to receive the information (eg electronically or printed and sent by post) and if you have any accessibility requirements (eg large fonts).

No, the UK GDPR and associated data protection legislation exists to protect the privacy of individuals and you have no right of access to the personal data of anyone other than yourself (with the exception of making a request on behalf of another person, see below). Please see ICO guidance on requests involving other individuals. 

There are rare exceptions to this rule where health and safety or legal matters are involved. Please contact us for further information.

Personal data is data that ‘relates to’ the data subject in some way. This means that it does more than simply identifying you – it must concern you in some way. Please see the ICO definition of personal data for detailed information.

The information held about you may also relate to other individuals. The university will consider the rights of thirds parties. In some cases, information will be removed or redacted before a copy is provided to you. In some cases, we may ask the third party for their consent to release the information to you. Some kinds of information are also exempt from disclosure and we consider whether any of these exemptions apply before providing the response.

You can ask for all the information an organisation holds about you. However, this doesn’t mean you will get all the information they have about you. An organisation can sometimes refuse to provide you with all or some of the information.

It might also mean you get a lot of information back that you don't need. Sometimes, the organisation is allowed to take longer to send it as well.

When asking for information, be as specific as possible. This will help you to get the fastest possible reply and more useful information back

Under the Data Protection Act 2018, there is an exemption that covers confidential references (both received and sent) from disclosure in answer to a subject access request. As such, these will not be disclosed in answer to such requests. The exemption covers references for employment, education, training and volunteering. Please note, that this is a change from how references were handled under the previous Data Protection Act 1998.

You can make a request for the personal information of another person. The university will need to be satisfied that you have the informed consent of that individual. In most cases, we would ask for an original signed form of authority.

UK GDPR (and associated UK data protection legislation) requires the university to provide the requested information within one month of receiving the completed request. This can be extended an additional two months for large and complex requests. A completed request means that we have received the written request, your ID and all of the information needed to locate your data. We may ask for your assistance in order to locate the requested information.

No, students can request copies of their exam scripts once marks have been provisionally approved by the Sub-Examination Board. Further information about the publication of exam results can be found in the Academic Manual. 

Requests for copies of exam scripts should be made directly to your Faculty in accordance with the Student Feedback on Assessment Policy.  

Please note that for some examinations, you may only receive a breakdown of where marks have been awarded.

If you are considering appealing your examination marks you should familiarise yourself with guidance on academic appeals. Please note that you do not require copies of your scripts in order to submit an appeal.

Under the UK General Data Protection Regulation (and associated UK data protection legislation), you have a number of rights beyond accessing a copy of the information King's holds about you. These rights are as follows:

• Right to be informed

• Right of access - see above

• Right to rectification

• Right to erasure/right to be forgotten

• Right to restriction

• Right to portability

• Right to object

• Right to not be subject to automated decision making

• Right not to be subject to automatic profiling

The GDPR Data Subject Rights form can be used to make a request under one of these rights, you can find this form below.

Please note, depending on why your personal data is being processed by King's not all rights will be available to you in all situations, or your request may be refused.

The Data Subjects Rights form contains guidance on when your rights can and cannot be exercised.