Subject Access Request to the Student Loans Company

Most of what people want from the Student Loans Company is already in the student loan repayment account. Signing in shows your balance, how much you have repaid, how much interest has been applied, which repayment plan you are on, and the letters and emails SLC has sent you. If that is what you are after, signing in to manage your student loan balance is much faster than a request. A subject access request cannot cancel a loan, settle a repayment dispute, or produce a statement any quicker than the account does. One route covers all four UK administrations. SLC's privacy notice covers applications made through Student Finance England, Student Finance Wales, Student Finance Northern Ireland and the Student Awards Agency Scotland, and names itself a joint data controller with the UK Administrations, the Education Authority and SAAS. The same address and the same email work wherever you applied. Appeals are the exception and are not subject access requests: SLC sends England and Wales to formal_appeals@slc.co.uk, Northern Ireland to the Education Authority, and Scotland to SAAS. SLC publishes a form but does not require you to use it. Post it or email it to DSR_SLC@slc.co.uk. DPO@slc.co.uk is a different address and is not the route for making the request — SLC publishes that one for questions about its privacy notice, how long it keeps things, transfers outside the EU, and withdrawing consent. Do not shorten the postal address. Three SLC documents give three different department lines at 10 Clyde Place: the form and the rights guidance say Repayment Enablement, Infrastructure and Verification (4th Floor), the privacy notice says Verification Operations, and the Data Protection Officer's own block gives the same street address again with no department at all. Use the full block above. SLC also says a request can be made by phone, on a different number depending on where you live: England 0300 1000607, Northern Ireland 0300 1000077, Wales 0300 2004050, Scotland 0300 1000609. These are the general student finance lines, so say at the start of the call that you are making a subject access request. Two things worth doing before you send it. SLC says call recordings are not routinely provided unless you specifically ask for them, so name them if you want them. And SLC says that if the personal information it holds does not match what is on your form, it will not be able to process the request — so update your address and contact details in your online account first. SLC keeps records for a very long time. It holds most of your information until the loan is repaid or cancelled, cuts it back six years after you finish or leave your course or six years after the loan is paid off, and then keeps a reduced Lifetime record until 70 years after your date of birth. The file covers your application, income information shared by HMRC, your repayment history and correspondence. SLC publishes one month, extendable by a further two months for a complex request, and says it will tell you inside the first month if it is extending. Its form adds two warnings the guidance does not: that requests for certain information may take longer than a month and may incur an administration fee, and that if it needs more information to identify you the month does not start until that arrives. There is normally no charge. Your university or college is a separate controller and holds different records — your academic file, attendance and disciplinary papers are theirs, not SLC's, and a university's own route is where those requests go. Data protection rights end when a person dies, so this is never the route for someone else's records after a death. SLC publishes a separate process instead: tell SLC that a customer has died and the loan is cancelled. You need the person's customer reference number and one of an original death certificate, an original coroner's interim certificate, a copy of a coroner's certificate stamped by the coroner, or a copy of a foreign death certificate.

Made under UK GDPR Article 15, subject to the exemptions in Schedule 2 of the Data Protection Act 2018

Central government departments hold large, long-lived files, and requests to them are usually tied to a decision the person is challenging: an immigration application, a benefit decision, a tax assessment. Naming the decision, the date and any reference number substantially improves what comes back.

Departments also have exemptions available to them that most organisations do not. Part 1 of Schedule 2 of the Data Protection Act 2018 lets them restrict access where complying would be likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty. HMRC relies on the last of these. Separately, an immigration exemption lets the Home Office restrict access where complying would be likely to prejudice effective immigration control. Both are limited to the extent of the prejudice — neither is a blanket refusal, and a department has to justify withholding rather than assert it.

The immigration exemption in particular has been narrowed by litigation. The Court of Appeal found it incompatible with the UK GDPR twice, in 2021 and again in December 2023, and it was amended after each judgment. Since the amendments in force on 8 March 2024 the Home Office must decide case by case, separately for each right, and afresh each time, must show a substantial risk that outweighs the risk to your interests, must record its reasons, and must tell you it has applied the exemption unless saying so would itself be prejudicial.

Departments run their own subject access routes rather than one central one, and several also publish a faster self-service channel that answers the same question for free. Using the wrong one is the most common cause of delay: a request sent to a general enquiry address gets rerouted, and a request for information already sitting in an online account gets refused as unnecessary.

• Immigration and visa application files
• Benefit claim records and decision notes
• Tax records and correspondence
• Records of a decision you are appealing
• Internal notes and assessments about you

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.