Individuals are entitled to see all information held about themselves, but personal data should only to be disclosed to third parties under specific conditions.
If you are concerned about a request for data, email the Data Protection team at firstname.lastname@example.org for advice.
Be open with individuals
Wherever possible, be open with individuals in relation to information held about them. If an individual wants to make a formal Subject Access Request under the Data Protection Act, they should be referred to the Data Protection team or to our guidance on making a Subject Access Request.
Take care with requests from third parties
Exercise caution if you are asked to disclose information about an individual to someone else, either within or outside the University.
Detailed guidance on dealing with data requests from third parties.
You can pass on information to other members of staff if they legitimately require the information for their duties, but in most other cases you must not disclose personal data without the individual's consent. Even parents, spouses, friends, partners or sponsors are not entitled to information without the Data Subject's consent.
There are times when you can pass personal information about an individual to a third party. Staff in the Student Records and Examination Office may legitimately disclose relevant data to appropriate third parties for purposes connected with a student's studies or to meet statutory requirements. The member of staff dealing with the request will need to be satisfied as to the legitimacy of the enquirer's identity and request.
The University also receives requests for information from bodies such as the police and the Inland Revenue. If you routinely disclose such data as part of your job, you should first take steps to ensure that requests are genuine and legitimate. The police have a standard form which they should use in connection with any requests for personal information.
All non-routine requests should be referred to the Data Protection team.
Disclosing information in an emergency
Personal information can be disclosed in an emergency. In such a situation, if necessary, personal information can be disclosed without consent. For example, if a member of staff or a student collapses and is unconscious, it would be permissible to inform medical staff that the individual suffers from diabetes.
You must not disclose any information about an individual to any other enquirers, without written and signed permission from the individual to release their personal data.