Requests for Personal Information
Requests for your personal information or Data Subject Access Requests (DSARs) must be made in writing. Please complete the Personal Information Request Form and submit via email or to our postal address.
DSARs help individuals to understand how and why organisations are using their data, and check they are doing it lawfully. For this information please see the KCL privacy notices.
There are a number of exemptions from the right of access and a DSAR might not be the best process to obtain the information you require. Contact us for further guidance.
What should I include?
Identification: a copy of your passport or driving licence or an original bank statement or utility. Current members of staff and current students should also provide a copy of their ID card.
A clear explanation of the information or data you require. The Information Commissioner's Office have produced guidance on requesting personal data which may assist you.
Can I get access to personal data that isn't my own?
No, the UK GDPR and associated data protection legislation exists to protect the privacy of individuals and you have no right of access to the personal data of anyone other than yourself (with the exception of making a request on behalf of another person, see below). Please see Information about other individuals
There are rare exceptions to this rule where health and safety or legal matters are involved. Contact us for further information.
What Information will I receive?
Personal data is data that ‘relates to’ the data subject in some way. This means that it does more than simply identifying you – it must concern the you in some way. Please What is Personal Data? for detailed information.
The information held about you may also relate to other individuals. The university will consider the rights of thirds parties. In some cases, information will be removed or redacted before a copy is provided to you. In some cases, we may ask the third party for their consent to release the information to you. Some kinds of information are also exempt from disclosure and we consider whether any of these apply before providing the response.
Can I request references sent or received about me?
Under the Data Protection Act 2018, there is an exemption that covers confidential references (both received and sent) from disclosure in answer to a subject access request. As such, these will not be disclosed in answer to such requests. The exemption covers references for employment, education, training and volunteering. Please note, that this is a change from how references were handled under the previous Data Protection Act 1998.
Can I make a request on behalf of another person?
You can make a request for the personal information of another person. The university will need to be satisfied that you have the informed consent of that individual. In most cases, we would ask for an original signed form of authority.
How long will this take?
UK GDPR (and associated UK data protection legislation) requires the university to provide the requested information within one month of receiving the completed request. This can be extended an additional two months for large and complex requests. A completed request means that we have received the written request, your ID and all of the information needed to locate your data. We may ask for your assistance in order to locate the requested information.
Do I need to make a request to receive my exam script?
No, Students can request copies of their exam scripts once marks have been provisionally approved by the Sub-Examination board. Further information about the publication of exam results can be found here.
Requests for copies of exam scripts should be made directly to the faculty in accordance with the revised guidance.
Please note that for some examinations, you may only receive a breakdown of where marks have been awarded.
You should note that decisions of Assessment and Sub-Assessment Boards cannot be challenged on academic grounds. If you are considering appealing your examination marks you should familiarise yourself with the student guidance on academic appeals.
Please note that you do not require copies of your scripts in order to submit an appeal.
Other rights that you have as an individual under UK GDPR
Under the UK General Data Protection Regulation (and associated UK data protection legislation), you have a number of rights beyond accessing a copy of the information King's holds about you. These rights are as follows:
Right to be informed
Right of access - see above
Right to rectification
Right to erasure/right to be forgotten
Right to restriction
Right to portability
Right to object
Right to not be subject to automated decision making
Right not to be subject to automatic profiling
The GDPR Data Subject Rights form can be used to make a request under one of these rights. Please note, depending on why your personal data is being processed by King's not all rights will be available to you in all situations, or your request may be refused. The Data Subjects Rights form contains guidance on when your rights can and cannot be exercised.