Data protection complaint against university

Two different things that are often confused

When people talk about a “data protection complaint” to a university they are usually doing one of two things, and the time limits are different for each. It helps to be clear which you are making, because you can make both at once.

The first is a data subject rights request. This includes a subject access request (asking for copies of your personal data), or a request to correct, erase, restrict, or object to processing of your data. These are legal rights under the UK GDPR and the Data Protection Act 2018.

The second is a data protection complaint. This is where you tell the university you think it has mishandled your personal data or breached data protection law, and you want it to investigate and put things right.

How to make the complaint

1. Identify the university’s data protection officer (DPO). Universities that are public authorities must have a DPO, and their contact details are usually published in the privacy notice on the university website. Address your complaint to the DPO or the data protection team.

2. Put the complaint in writing, by email or letter, and keep a dated copy. State clearly that you are making a data protection complaint and, if relevant, that you are also making a subject access request or another rights request. You do not have to quote legislation, but naming the UK GDPR and Data Protection Act 2018 helps.

3. Set out the facts concisely: what personal data is involved, what the university did or failed to do, the dates, and why you say this breached data protection law. Attach any supporting evidence such as emails or screenshots.

4. Say what you want. This might be an explanation, correction or deletion of data, an apology, a change of practice, or confirmation of what has happened. Being specific about the outcome you seek makes it easier for the university to respond meaningfully.

5. Check whether the university has an internal data protection complaints procedure and follow it, but you are not obliged to use any particular form. A clear written complaint to the DPO is sufficient.

How quickly the university must respond

The answer depends on which request you are making.

For a subject access request or other data subject rights request, the university must respond without undue delay and at the latest within one calendar month, starting from the day it receives the request (or from when it receives any ID or clarification it reasonably needs to deal with it). It can extend this by up to two further months, giving a maximum of three months in total, but only where the request is complex or you have made several requests. If it extends, it must tell you within the first month and explain why.

For a data protection complaint (as opposed to a rights request), the position changed under the Data (Use and Access) Act 2025. An organisation must acknowledge your complaint within 30 days, take appropriate steps to investigate it, keep you informed, and give you a final response without undue delay. There is no fixed statutory deadline for the final response in the way there is for a rights request, but delay must be justifiable.

If you are not satisfied with the response

If the university does not respond in time, refuses your request, or gives an inadequate reply, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. The ICO generally expects you to raise the matter with the organisation first and to give it a reasonable opportunity to respond. As a rule of thumb the ICO suggests waiting until the organisation has had a chance to reply and, for complaints, allowing time for its final response before escalating; you should complain to the ICO within three months of your last meaningful contact with the organisation about the issue.

Keep a record of every date and every message. When you complain to the ICO you will need to show what you asked for, when, and how the university responded.

Other routes worth knowing

The ICO can investigate and require the university to take action, but it does not usually award compensation. If you have suffered material damage (financial loss) or distress because of a data protection breach, you can bring a separate claim for compensation in the courts under the Data Protection Act 2018. That is a more involved and costly step, and is usually only worthwhile where there is genuine, demonstrable harm.

If your underlying concern is really about an academic decision, misconduct process, or other university treatment rather than the handling of your data, the university’s own complaints procedure and, ultimately, the Office of the Independent Adjudicator for Higher Education may be the more appropriate route. Data protection complaints and academic complaints are separate systems, though they can overlap.

Practical points

Sending the complaint and any rights request together, clearly labelled, is efficient and starts both clocks running. Diarise the one month deadline for any rights request and the 30 day acknowledgement point for the complaint, so you know when the university is out of time. If a deadline passes, a short chasing email referring to the statutory time limit often prompts a response before you need to involve the ICO.

The strength of any eventual complaint to the ICO or claim in court will depend on facts you have not yet set out, in particular exactly what data is involved, what the university did, and what harm, if any, resulted. Gathering and dating that evidence now will help whichever route you end up taking.