Principle 6: Personal data shall be processed in accordance with the rights of data subjects under the act

The Data Protection Act 1998 gives the data subject increased rights of access to personal data held on them. The Act also provides strict time limits in which data controllers must respond to access requests from individuals. Principal 6 requires data controllers to comply with these rights.

Subject to some exceptions, subject access requests must be dealt with within 40 days of the access request being received in the University. As each request is liable to be different, staff and students may, in all cases, obtain advice on how to proceed and whether information can be disclosed and can be obtained from the University's Assistant Data Protection Officer.