What is a Data Subject Access Request (DSAR) and how do I make one?

What is a Data Subject Access Request (DSAR) and how do I make one?

Back to “Data Protection”

Last Updated: July 15th 2021

You have the right to access your personal data held by Newman University.

If you are a current student the best way to access your student information and record is by logging onto MyNewman.

Via MyNewman you can access your photo, full name, Newman and personal email address, permanent address and contact address, phone numbers, accommodation type, local education authority, date of birth, gender, ethnic origin, disability, country of domicile, nationality, UCAS number, Student Loans Company number, modules and your transcript (i.e. your results which have been confirmed by a Board.

Via MyNewman you can update your permanent address and contact address, personal email address, phone numbers and accommodation type.

You can also access your personal data on Moodle / Mahara, Turnitin, Panopto / MyCareers / Library self-serve kiosk and the E-store.

If you are a current member of staff the best way to access your staff profile, including special category data is to log onto iTrent.

Via iTrent you can access and correct / update your title, first name, surname, date of birth, address, phone number, staff email address, emergency contact name and bank details.

Via iTrent you can access and add / update / remove your other names, address, marital status, religion, ethnic origin, nationality, gender, gender reassignment, sexual orientation, self-certification of disability, special requirements and emergency contact details.

Via iTrent you can access your absence record (sickness and holiday), pay and benefits information, career and development (training) record.

You also have access to your personal data via the library self-serve kiosk and the E-store (if you have used it).

If you wish to enquire about the personal data which the University holds about you, and it is not accessible via MyNewman or iTrent you may make a data subject access request (DSAR). Only information which is considered to be your personal data will be released under a DSAR unless you can prove that you have the legal right to access personal data on someone else’s behalf.

How do I make a DSAR?

In order to speed up the process for us to respond to your request, we ask that you complete Newman University’s Data Subject Request Form available for download from the bottom of this page. You can  post it to us or attach it to an email. You do not have to use the form but it may help you and us if you do. If you wish for any specific documents to be located and/or areas of the University to be searched this should be indicated clearly on the Data Subject Request Form / in the request. The more specific you are and the more information that you provide us with, the better we will be able to respond to your request.

Please send your DSAR by email to our Data Protection Officer dpo@newman.ac.uk or by post to Data Protection Officer, Newman University, Genners Lane, Bartley Green, Birmingham, B32 3NT. You may also phone or use social media to request a DSAR but we recommend that you use the form and email it to us.

If you find it impossible or unreasonably difficult to make a request in writing, we will make a reasonable adjustment for you under the Equality Act 2010. If this applies to you, please contact us on 0121 476 1181 ext. 2500 or visit us in person. You can also request a response in a particular format that is accessible to you.

When we have received your DSAR, we will contact you to confirm receipt and to arrange / carry out an ID check. You will need to provide proof of identity such as your student or staff ID card, a driving license, passport or similar. We require this information within the law to be sure that we are releasing data to the correct person.

A DSAR will be treated in confidence and will only be processed by authorised staff in relevant departments who have been contacted in order to locate and process the DSAR.

How quickly will the University respond to my DSAR?

We will acknowledge your request at the latest within one month of receiving the required documents and will usually respond to your request within one month. If the DSAR is complex or you have submitted numerous DSAR we have the right to extend the period of compliance by a further two months. If this is the case, we will inform you within one month of receiving the request and explain why the extension is necessary.

Where requests are manifestly unfounded or excessive, in particular because they are repetitive, we can:

  • charge a reasonable fee taking into account the administrative costs of providing the information; or
  • refuse to respond.

If we refuse to respond to a request, we must explain to you why we have made that decision and remind you of your right to complain to the ICO and to a judicial remedy without undue delay and at the latest within one month.

How should the information be provided?

If you submit a DSAR electronically e.g. by email or an attachment to an email, we you should provide the information in a commonly used electronic format e.g. by email or an attachment to an email (such as a pdf or csv file).

If we process a large quantity of information about individuals, the law allows us to ask you to specify the information the request relates to.

Is there any personal data that cannot be accessed?

The anonymity of other individuals or other information which is not considered to be your personal data may be protected, as appropriate, by redaction or omission in accordance with the law. Personal data that has already been deleted in accordance with our data retention policies will not be able to be retrieved.

Certain personal information cannot be obtained under the General Data Protection Regulation and remains exempt under Freedom of Information Act.  This includes:

  • Confidential references provided or received by the institution
  • Negotiations in dispute with individuals
  • Examination scripts
  • Correspondence with solicitors

Most tutors at Newman University allow students to see references written for them but the other information will not be made available.

If an organisation reasonably needs more information to help them find your information or identify you, they have to ask you for the information they need. They can then wait until they have all the necessary information as well as the fee before dealing with your request.

The organisation should give you the information in writing but they need not do this if it is not possible, if it takes ‘disproportionate effort’ or if you agree to some other form, such as seeing it on screen. The law does not define what disproportionate effort means but we think the following should be taken into account:

  • the cost of giving you the information;
  • the length of time it will take;
  • how difficult it will be;
  • the size of the organisation; and
  • the effect on you of not having the information in permanent form.

Can I access personal information on someone else’s behalf?

The General Data Protection Regulation does not stop you making a request on someone else’s behalf. This is sometimes necessary for a solicitor acting on behalf of a client, or it could simply be that an individual wants someone else to act for them. In these cases, the University will need to satisfy itself that the person making the request has the individual’s permission to act on their behalf. It is the third party’s responsibility to provide this evidence, which could be a written authority to make the request, or a power of attorney. If a person does not have the mental capacity to manage their own affairs and you are their attorney, for example you have a Lasting Power of Attorney with authority to manage their property and affairs, you will have the right to access information about the person you represent to help you carry out your role. The same applies to a person appointed to make decisions about such matters: in England and Wales by the Court of Protection, in Scotland, by the Sheriff Court and in Northern Ireland, by the High Court (Office of Care and Protection). The General Data Protection Regulation only applies to personal information about a living individual.

Article Attachments

Was this article helpful?

  1. Home
  2. Help & Advice
  3. Corporate Information
  4. Data Protection
  5. What is a Data Subject Access Request (DSAR) and how do I make one?