skip to primary navigationskip to content

Subject Access Requests

The ICO updates its guidance on General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) regularly. It also offers a range of resources and support that can be accessed here.

Under the GDPR, individuals have the right to access the personal data which an organisation holds about them. Such requests are submitted to organisations as Subject Access Requests (SARs). For more information, see the ICO’s guidance on handling SARs.

The Office of Intercollegiate Services has produced the following templates for the Colleges to use when responding to SARs: 


The Data Protection Act 2018 (DPA 2018) contains a list of exemptions that provide the grounds upon which organisations may not have to comply with the rights and obligations set out under the GDPR and DPA 2018. For more information, see the ICO’s guidance on these exemptions.