Data subject request

You can request to view any of the personal data we hold about you, or to exercise any of your data protection rights. Requests from data subjects or their representative can be made using this online data subject request form.

The information in the form is required to help us provide a timely and accurate response to your request and will only be retained as part of our record keeping for the Information Commissioner's Office.

Before you submit this form

  • Staff – You may find it quicker and more effective if you talk to your HR partner in the first instance.
  • Students – You are advised to contact your tutor about the information you require.

Should you still wish to submit a data subject request, please complete the form below. If, for accessibility reasons, you need to make the request in an alternative format, please email

About you

About the data subject

If you are the data subject of this request, please go straight to the next section.

Have you received permission from the data subject to request this information and how was permission provided? 

We may contact you to provide evidence of permission.

About the data subject’s association with Kingston University

Note: this information will be used to verify your/the subject’s identity. Please provide as much information as possible to help us deal with your request promptly. Kingston University may contact you to provide further verification if necessary.

About your request

Type of requests:

  • Right of access / Subject access request (SAR) – The right to ask an organisation whether or not they are using or storing your personal information and to ask for copies of your personal information. 
  • Right to rectification – The right to request to have inaccurate personal data rectified, or completed if it is incomplete.
  • Right to erasure – This right is also known as “the right to be forgotten”. Individuals can make a request to have personal data erased. Please note, this is not an absolute right and we may have a justification to retain parts of your data e.g. if you have received an award from the University.
  • Right to restrict processing – The right to request the restriction or suppression of personal data. This is not an absolute right and only applies in certain circumstances. Restriction allows data to be stored without processing.
  • Right to object – The right to object to the processing of personal data. Only applies when the legal basis is legitimate or public interest; when the processing is for direct marketing; or the processing is for research or statistical purposes.

For more information, see Individual Rights under GDPR.

Please select the type of request you are making

Please provide full details of your request. 

For a subject access request (SAR), please describe the information that you are interested in obtaining. Provide as much detail as possible, including but not limited to:

  • keywords to search by
  • anything specific that you would like to know
  • where the information is held, if known
  • relevant dates from and to


Please read the following declaration carefully and tick 'yes' below to indicate that you have read and understood the declaration statement:

I hereby certify that the information I have provided in this Data Subject Request form is accurate.

I understand that it may be necessary for Kingston University to:

  • contact me by email to confirm my identity and where applicable, verify my right to make a request on behalf of a data subject
  • contact me by email to request more details to assist the locating of the correct information
  • review and redact information released, in order to protect other people’s personal data
  • ask other members of staff to search, disclose, amend, redact or delete information

We collect your personal data via this form and in correspondence with you about your request.

We may process any information about you in responding to your request, depending on the nature of the query.

Your information will only be used to respond to your request.

The lawful basis for processing your data is that it is necessary for us to comply with the law, specifically the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Any special category data we may process is for reasons of substantial public interest, to meet regulatory requirements.

We may share your information with other members of staff as necessary to respond to your request, and with our external partner for redaction.

We will retain your request, related correspondence and our response for a period of two years, after which it will be deleted.

If you have further questions, please email

If you are not satisfied, you can make a complaint to the Information Commissioner. You can find out more about your rights under data protection legislation from the Information Commissioner's Officer website.