What is a SAR?

A Subject Access Request is a right that allows individuals to ask organisations what Personal Data they are holding about them and how it is being used, subject to certain limitations and exceptions.

Although SARs are managed by the Data Protection team, there are legal requirements and statutory timescales that every University staff member should be aware of.

What do I do if I receive a SAR?

If you are told by someone that they want to view the Personal Data that the University has about them, you must immediately forward the request to the Data Protection team at dataprotection@bath.ac.uk

Such a request is still valid regardless of whether or not “Subject Access”, “SAR” or “data” is mentioned, and regardless of how the request has arrived, e.g., by email, over Teams, or verbally.

The Data Protection team must legally respond without undue delay (and within 30-days) from the moment that anyone at the University receives the SAR. Therefore, even if you are unsure if a request constitutes a SAR, please contact the Data Protection team at once.

What do I do if the Data Protection Officer contacts me about a SAR?

The Data Protection team may contact you if you have Personal Data relating to someone who has submitted a SAR.

You legally must comply with this request and actively search for any relevant data that you may have, as well as letting the Data Protection team know if there any other systems or groups in the University who may also hold pertinent data.

It may be time consuming to comb through documents to find the requested Personal Data, but you do not know how important this information may be to someone, they may need it for a visa application, to show their parents that they have been studying, or simply to give them the assurances that the University processed their data fairly and lawfully.

Additionally, the Personal Data must be searched for regardless of what form the information is in, including formal correspondence, emails, Teams Chats, electronic and paper records, and University data bases. You must never process work information outside of approved systems (e.g., discuss student performance through WhatsApp) but if you do, this may be in scope of the request.

What if I have concerns about something being disclosed?

Even if a piece of information is embarrassing, unhelpful, or harmful to the University, you cannot knowingly delete or refuse access to it, that may constitute a criminal offence.

However, if you spot mistakes in the data, you can correct this as long as you provide a copy of both the incorrect and the corrected data.

If you are in doubt as to whether something needs to be included/disclosed, you must provide it to the Data Protection team who will make the final decision. If documents contain someone else's data (i.e., they mention someone other than the person making the request), the Data Protection team may apply exemptions and redactions where appropriate.

If you are concerned about a specific SAR or are considering putting in a request yourself and you want to know more about the process, please contact the Data Protection team.

Where can I get more information?

You can contact the Data Protection team with any questions or concerns at dataprotection@bath.ac.uk

There is also extensive guidance on Subject Access Rights available on the ICO website and you can read our blog about SARs.