Privacy Notice for Data Subject Rights Requests

1. Who are we?

Birmingham City University is the data controller. To submit a SAR, please email To submit any other data subject rights request or to make other enquiries please email

You can contact our Data Protection Officer by emailing or by post to:

Data Protection Officer
Information Management Team
Birmingham City University
Floor 1, Joseph Priestley Building
6 Cardigan Street
Birmingham, B4 7RJ

2. What type of personal data is collected?

Living individuals (data subjects) have a number of rights under data protection laws. You can read about them on this ICO webpage. When you submit a request related to one of those rights (for example, a Subject Access Requests (SAR), Rectification Request, Erasure Request, Data Portability Request, Restriction Request, Objection Request or request for human interaction in an automated decision-making process including profiling) or a complain related to any of the above, you provide BCU with personal information including your name and contact details.

The legal basis for BCU processing this personal information is ‘legal obligation’ as we have a legal obligation to respond to request or related complaint. You might choose to include some information called ‘special category personal data’ under data protection law. We encourage you to only provide us with the minimum information we need in order to carry out your SAR. This includes information about your health (including mental health), race, ethnic origin, religion, sexual orientation, political opinions, philosophical beliefs, trade union membership, genetic data and biometric data. 

The special condition permitting the processing of the special category personal data depends on the context. It might be Article 9(2)(b) ‘Employment, social security and social protection law’, which would include the Equality Act 2010, or it might be Article 9(2)(a) ‘Explicit consent’. Therefore please only include any special category data you explicitly consent for BCU to process, otherwise we will not be able to process your request.

3. How will the personal data be used and how long is it kept?

BCU will use your personal data to help respond to your request or related complaint. We keep your request documentation on file for up to the last action plus 6 years, unless there is an identified need to keep it for longer. We may keep your name, relationship with BCU (e.g. former student, member of the public etc.) and date of the request (or related complaint) on a register for 10 years for monitoring purposes.

4. Who can access my personal data and will they share my personal data with anyone?

Your personal data will only be accessible to relevant staff, for example staff involved in responding to your request and a related complaint and, where relevant, HR. Hard copies of personal information are kept in locked storage and personal data stored electronically is on secure systems within the UK or EU.

BCU would only share the personal data you have provided as part of the request with an external organisation if it was needed in order to process the request (e.g. we needed to inform a data processor of a rectification), if we believe we are compelled to by law or we seek external assistance such as a consultant or legal advice.

5. What rights do I have regarding my personal data?

You have the right to correct or update your personal data at any time. You have the right to request access to your personal data. You have the right to request the restriction of the processing of your personal data. If we are processing your personal data on the basis of your consent, you have the right to withdraw your consent at any time. However, if you choose to retract your consent before your request or related complaint is considered, we will not be able to take the personal data that was relying on your consent into consideration.

To correct or update your personal data in relation to your request or to retract your consent for the processing of any special category data within the request or complaint, or to retract the request itself, please email unless it relates to a Subject Access Request, in which case please email To read more about your rights please go to the ICO website

If you are not satisfied with the response to your request, you have the right to lodge a complaint with the Information Commissioners Office about the handling of your personal data and can find out more about this on their website

Issue no: 1
Issue date: 25/03/2024