Subject Access Request to University College London

UCL's route is one form for everybody — staff, students, applicants and other users of its facilities — completed and emailed to data-protection@ucl.ac.uk. The form is not compulsory: UCL says a request may be submitted in whatever format you wish and that the form exists for your convenience, and its own staff guidance says a requester cannot be made to use it. UCL does not charge a fee. There is no postal route. UCL's data protection team publishes email addresses and says its office address is provided upon enquiry, and no UCL data protection page, privacy notice or form carries one. The address on this page is UCL's general address, which is also the address on its ICO registration. If you do write, UCL asks you to include the recipient's name and department, so mark the letter for the Data Protection Office. If you are a current student or member of staff your UCL ID card is enough, and UCL asks you to write from your UCL email address because it helps confirm who you are. If you have left, UCL asks for one photographic document — it names a passport, driving licence, railcard or business ID card — and one proof of address such as a council tax bill, utility bill or bank or credit card statement from the last three months. UCL says it normally answers within one month, counted from the day after your request arrives or from the day it has satisfactory proof of your identity, and that a complex or repeated request can take up to three months in total. When it logs your request it automatically creates a MyServices account for you; activating it is optional, and UCL says you will get the full response by email either way. Your exam scripts are exempt and UCL says it is its policy not to provide copies of them. Examiners' comments are a different matter: UCL says those are your personal data and that you are entitled to view and receive copies, and it encourages academic departments to hand them over rather than make you file a formal request. Third-party data is redacted by default, and only the Data Protection Office can refuse a request. UCL is not the hospital. It says UCLH is a separate legal entity that is sometimes confused with it, so hospital records need their own request — the NHS subject access request guide explains that route. For the health records of someone who has died the right sits under a different statute altogether: see how to access medical records. If what you need is proof rather than the record itself, a subject access request is the slow way round. UCL says a statement of student status and a statement of award can be obtained free of charge, and that final-year students are sent their degree certificate and a copy of their official transcript within three months of the date of award. Current students get one free e-transcript per academic year, and once the three-month self-serve window has passed an e-transcript costs £18.00 including VAT. A transcript is an official record of your confirmed results for third-party verification, and a subject access request is not a substitute for one. askUCL covers current students and up to two years after graduation; former students who cannot use it are told to email studentstatus@ucl.ac.uk. UCL lists deceased persons among the things data protection law does not cover, and publishes no alternative route of its own, so a subject access request cannot be used for the records of someone who has died.

Made under UK GDPR Article 15, subject to the examination exemptions in Schedule 2, Part 4 of the Data Protection Act 2018

An exam board holds your entries, candidate number, marks, moderation and appeal records, and its correspondence with your school or college about you. A university or college holds all of that plus your student record, admissions file, misconduct and fitness-to-practise files. Requests usually arise from a disputed grade, an appeal, a misconduct allegation, or simply needing a record of results from years ago.

Your exam answers are treated differently in law. Under paragraph 25 of Schedule 2, Part 4 of the Data Protection Act 2018, the right of access does not apply to information recorded by candidates during an exam — so, as the ICO puts it, candidates do not have the right to copies of their answers to the exam questions. What the marker recorded is a different matter: the ICO's guide to the exemptions states that information recorded by the person marking the exam is not exempt, so marks and examiners' comments are within scope even though the script itself is not.

There is a timing rule for marks, and it is narrower than it is often described. It applies only where you ask before the results are announced. In that case the organisation must answer within five months of the request, or within 40 days of the results being announced if that comes sooner. Ask after results day and the ordinary deadline applies in full, as set out below.

• Marks, moderation records and examiners' comments
• Entry records, candidate numbers and the results held against your name
• Appeal, review-of-marking and malpractice records
• The full student record and admissions file, at a university or college
• Emails about you between staff, or between the organisation and your school

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.