OfS privacy
Individual rights and requests under the UK General Data Protection Regulation
You have a number of rights over the way organisations use your personal information. These are set out in the UK General Data Protection Regulation (UK GDPR).
These rights are:
- the right of access to personal information
- the right to correct inaccurate personal information
- the right to have personal information deleted (within certain limits)
- the right to restrict the use of personal information in certain circumstances
- the right to have a copy of personal information provided to them in a commonly used machine-readable format (to allow easy transfer to another data controller)
- the right to object to the use of personal information where it is based on specific legal bases
- the right to object to the use of automated decision making, including profiling.
These rights are not absolute rights and have certain limitations depending on the request, the lawful bases and the purposes for which we are processing your personal information.
Requests for your personal information
Data protection legislation gives you the right to know what information the OfS holds about you and how it is used. If making such a request, you have the right to be informed of:
- the reasons we hold and use your information
- the categories of information we hold about you
- who we give your information to
- where possible, how long we will hold your information
- the right to ask us to rectify, erase or restrict use of your information (within certain limitations)
- your right to complain to the Information Commissioner
- where we have information about you from other sources, where that information was obtained from
- whether any automated decision-making, including profiling, takes place and, if so, meaningful information about the logic involved and the significance and any envisaged consequences for you.
How to request your personal information
Requests for access to copies of your personal information, also called Subject Access Requests (SAR), should be made in writing. A request may be received from the agent of an individual, in which case the agent must provide satisfactory evidence that they have the authority of the individual.
Please provide the following information:
- Your name and contact details. We may need further information from you to verify your identity. If this is the case, we will explain to you exactly what we require.
- If you are acting as an agent for someone else, please provide the name and contact details of both yourself and the data subject, as well as the nature of your relationship. Please note, the data subject’s written authority for you to submit a request on their behalf must be provided for us to process the request.
- It would also help us to narrow our search if you could tell us which team or directorate you believe might hold personal information relating to you. If you are not sure, please tell us the context in which you have had dealings with us, and when. We may ask for further information to narrow the search sufficiently and to be able to provide a response within the statutory time limit.
Where to send your request
You can send your request by email to: [email protected]
You can also make your request in writing, to:
Office for Students
Westward House
Lime Kiln Close
Stoke Gifford
BRISTOL
BS34 8SR.
Time limit for response
Once the above evidence is provided and we are satisfied with the identity and authority of the request, we will provide a response within one calendar month.
In circumstances where the request is excessive, we may extend the deadline for up to two months to provide a full response. If so, we will notify you of this extension and the reason it has been applied.
Fees
Where a request is considered to be 'manifestly unfounded or excessive' or repetitive, we may either:
- charge a reasonable fee to take into account the administrative costs of providing a response; or
- refuse to act on the request.
Where one of the above options is invoked, we will set out in writing the reasons it has been applied to your request.
Contact the OfS's Data Protection Officer
Please email [email protected] if you would like to discuss how your personal data is processed by the OfS and how you may exercise your rights under data protection legislation.
Further information
The Information Commissioner’s Office (ICO) publish further information about these rights:
Read the ICO's guide to your data protection and information rights
11 August 2026 - We have added information about how to make a request for your personal information, which was previously elsewhere on our website.
Describe your experience of using this website