Subject Access Request to UCAS

UCAS is the trading name of the Universities and Colleges Admissions Service, an independent charity and a company limited by guarantee registered in England and Wales as company 2839815 and as charity 1024741, and in Scotland as SC038598. Its ICO registration is Z7293924. Its privacy policy says some services are offered through "our wholly owned trading subsidiary, UCAS Media Limited" and that data "may pass between UCAS and UCAS Media as the UCAS Group" — UCAS Media is a separate controller with its own registration, Z7488231, at the same Cheltenham address. UCAS publishes no separate route for UCAS Media, so the email address above is the one to use either way, but say if it is your marketing record you want. Most people want the reference, and you can have it. UCAS's own applicant page says of the reference your school writes that "you won't have access to this", and its FAQ answers the obvious next question: "Your reference is not normally available for you to see; the easiest way to see it is to ask your referee for a copy. If this isn't possible, under the Data Protection Act, we can provide a copy of your application." UCAS calls that a "copy form" request, and it is made by telephone rather than by email: ring the Customer Experience Centre on 0371 468 0 468, or 0371 468 0 470 for Conservatoires, Monday to Friday between 08:30 and 18:00. You verify yourself on the call with your Personal ID and questions about your profile, and the documents are emailed to you. UCAS says you can ask for "your personal statement or your reference just by itself" rather than the whole application. A subject access request is the wider route and it is the one above. UCAS asks you to email it with the details listed under "ID they ask for", including which of its services you have used, so that it knows which systems to search, and says "we will send a response to you within one month". Before you ask, it is worth signing in and looking: UCAS's app privacy notice says under the right of access that "You can view the information we hold about you through the App or UCAS Hub through UCAS.com", which is free and immediate, though it is your Hub account rather than the "all information the information UCAS holds about me" its request page describes. UCAS publishes no online form and no portal for a request — the only web form it offers for personal data is for police forces, coroners and statutory agencies, and that page says in terms that it "cannot be used by individuals to access their own personal data (e.g. subject access requests)". A written request is valid however you send it, and the postal address above is UCAS's own designation for exercising your rights; general correspondence goes to the same building at UCAS, Rosehill, New Barn Lane, Cheltenham, Gloucestershire, GL52 3LZ. UCAS is not the body that decided your application, and a request to UCAS will not tell you why you were turned down. Its own FAQ says "We only advise your choices about the similarities in your personal statement. We are not involved in the decision-making process", and tells applicants to "Contact your choices directly for feedback about your application". On unsuccessful choices it says only that "Sometimes they'll give a reason, either with their decision or at a later date. If not, you can contact them to ask if they'll discuss the reason with you." The university or college is a separate data controller holding its own admissions file — University College London is one such page here — and admissions reasoning is usually an opinion recorded about you rather than something a request compels anyone to create. Your application carries things you were never shown back. Equality monitoring is optional and, UCAS says, information about "ethnicity, sexual orientation, identification as transgender, and religious belief" is "provided to your chosen providers after you've secured your place, or at the end of the application cycle", so it plays no part in the decision; it is processed under Article 9(2)(g) as being in the substantial public interest. Free school meals data feeds contextual admissions and the Multiple Equality Measure score. Performance information about your school is shared with the providers you apply to. UCAS runs similarity checks on personal statements and says it may notify your school and your choices if it thinks material was copied, "including but not limited to friends, writing service providers or artificial intelligence software". Your school or centre can see your application and its outcome, but UCAS says it cannot "see any information you provide about your sexual orientation, gender identity or religious belief". UCAS keeps applications for a very long time, which is the reason a request is worth making years later. Its own page says that data retained for public-benefit research is "subject to long-term retention for a minimum period of 15 years and continued retention will be reviewed at an appropriate period", relying on Article 89(1), and that it links admissions data to other datasets including the national pupil database. It says it cannot anonymise your record instead, because "being able to identify specific individuals is necessary for our research". Two things are shorter: documents you uploaded to support the application "are retained by UCAS only for the duration of the admissions cycle", and UCAS says it keeps call recordings "for three months for training purpose" — though it adds that "in exceptional circumstances, we may keep recordings for longer, for example … if you have requested a copy of the call", so three months is a default rather than a ceiling. Clearing, Clearing Plus and Extra sit inside the same application record. UCAS says it keeps a record of the courses you show an interest in through Clearing Plus, and that selecting "I'm interested" shares your name and contact details with the provider, which can then see "additional information, including your personal statement and qualifications". Extra ran between 26 February and 1 July 2026. Adjustment no longer exists — UCAS's page says "Adjustment is no longer available from 2022 entry" — so an adjustment record only exists if you applied for 2021 entry or earlier. Payment records are in there too: the 2026 application fee was £28.95 for up to five choices, and a receipt for it is another telephone request to the Customer Experience Centre. If you are a parent, note what nominated access is and is not. UCAS lets an applicant add someone in the contact details section of the application, which "allows you to contact UCAS – or the universities they have applied to – on their behalf to discuss the status of their application" with the applicant's Personal ID and some security questions. That is a conversation about progress, not a subject access request. UCAS publishes no route for a parent to request a seventeen-year-old's record, and the right belongs to the applicant — how requests by and for children are judged sets out when a parent can act. A solicitor acting for you sends a signed form of authority with your name, date of birth and the address on your application. Freedom of information is a different right, a different desk and a different deadline. UCAS is a charity rather than a public body and is covered by the Freedom of Information Act only "in relation to some of its functions" — the admissions service — under an order in force from 1 November 2011. Those requests go to foi@ucas.ac.uk or to the Information Governance Team at Rosehill, New Barn Lane, and get 20 working days. That route cannot give you your own file. A request about someone who has died is not a subject access request, and we cannot take one — rights of access end at death. UCAS does publish a route: it says it "will only release the records of the deceased if the request has been made by the deceased persons 'personal representative'", by grant of probate or letter of administration, and asks for that document, one photographic identity document and something showing your own name and address, the person's details, and the records you want, emailed to the address above. Separately, if what you want is your school's own file rather than UCAS's, that is a records request to the school, and if a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.