Preserving university records during complaint

The core issue

The situation you describe involves two separate things that are easy to conflate. The first is your practical access to a university IT account (email, virtual learning environment, file storage) that lets you log in and download material. The second is the university’s legal obligation to hold, preserve and give you access to your personal data. Losing your login does not automatically mean the underlying evidence is gone, and it does not remove your right to obtain it. Understanding this distinction changes what you should do.

Why accounts get deleted, and whether it is wrongful

Before treating account deletion as an act against you, it is worth identifying the ordinary explanation. Universities routinely deactivate or delete student IT accounts a set period after a student graduates, withdraws or is deemed to have left. This is usually driven by IT policy, licensing costs and data minimisation obligations under the UK GDPR, which require organisations not to keep personal data for longer than necessary. Deactivation on that basis is normally a routine administrative process, not misconduct and not an attempt to destroy evidence.

It becomes a more serious problem only if the university deleted or destroyed material after it knew, or should reasonably have known, that the material was relevant to a live complaint, appeal or potential legal dispute. If you had already told the university you were bringing or considering a complaint, an organisation acting properly should preserve relevant records rather than allow them to be routinely purged. Whether anything wrongful has happened therefore turns on timing and knowledge: when did you notify the university of the complaint, and when was the account or data deleted.

Your data protection rights

The most powerful tool you have is the right of access under the UK GDPR and the Data Protection Act 2018, commonly called a subject access request or SAR. This right exists independently of whether you can log in. You do not need an active account to make a SAR, and the university cannot lawfully refuse simply because your account has been closed. In response the university must confirm whether it processes your personal data, provide a copy of that data, and give supporting information about the processing. This can capture emails to and from you, records about you held by staff, records of decisions, and other personal data, which may include much of the evidence you need.

There are limits worth knowing. The right of access covers your personal data, not every document in existence, so material that is not your personal data may fall outside it. There are exemptions, for example for examination scripts (as opposed to examiners’ comments) and for certain confidential references. Where a document contains other people’s personal data, the university may redact or withhold parts. The response is normally due within one month, extendable by up to two further months for complex or numerous requests, and it should usually be provided free of charge.

On deletion specifically, the Information Commissioner’s Office takes the view that information is treated as deleted once an organisation has permanently discarded it with no intention of accessing it again, and it does not have to go to disproportionate technical lengths to recreate genuinely deleted data. So if material was truly deleted before you asked for it, a SAR may not recover it. But if the account was merely deactivated, or the data still exists in backups, archives, staff mailboxes or central systems, it should still be retrievable and disclosable. It is common for the individual login to be removed while the underlying institutional records remain.

Practical steps to secure the evidence

1. Act immediately in writing. Send a short email now to the university, ideally to the relevant department and to the data protection officer, stating that you have a live or intended complaint, identifying the material you need, and asking the university to preserve and not delete or destroy any relevant records pending resolution. This creates a record and puts the institution on notice, which matters if anything is later lost.

2. Make a formal subject access request. Address it to the data protection officer, ask for a copy of your personal data, and be as specific as you reasonably can about the categories of material and the date range so it is easier for them to locate what you need. Keep it broad enough to capture emails, VLE records, assessment records and internal correspondence about you.

3. Ask separately for the specific documents you need for the complaint. Some material you want may not be your personal data, so also ask the relevant office directly to supply copies under the complaints process itself. Universities are generally expected to give complainants the evidence relevant to their own case.

4. Preserve your own copies. Gather anything you already hold outside the account, such as forwarded emails, screenshots, downloads, saved coursework, feedback, submission receipts and dates. Contemporaneous evidence of what the account contained and when you lost access is useful.

If evidence has genuinely been lost or destroyed

If it turns out relevant material was deleted after the university was aware of your complaint, that fact can itself strengthen your position rather than defeat it. Decision-makers in complaints processes can draw sensible inferences where a party has failed to preserve evidence it controlled, and a university acting fairly should not benefit from losing records it ought to have kept. Set out clearly, with dates, what you asked for, when you notified them, and what has been lost, and ask the university to explain when and why the material was deleted and what backups exist.

Escalation routes

For the complaint itself, work through the university’s internal complaints procedure first, because external routes almost always require the internal process to be exhausted. Once you have a final decision or a Completion of Procedures letter, or if the internal process is unreasonably delayed, you can take the complaint to the Office of the Independent Adjudicator for Higher Education, which reviews student complaints against most higher education providers in England and Wales. Keep the OIA’s time limits in mind, as complaints must generally be brought within twelve months of the Completion of Procedures letter.

For the data protection aspect, if the university fails to respond properly to your SAR, refuses without valid exemption, or you believe data was mishandled or wrongly destroyed, you can complain to the university and then to the Information Commissioner’s Office, which regulates data protection compliance.

Key facts that will change the answer

The right approach depends heavily on details you have not yet given. It would help to know the sequence and dates: when you notified the university of the complaint, when the account was deactivated or deleted, and whether it is merely inaccessible to you or actually purged. It also matters what type of evidence you need, because personal data, general documents and exam scripts are treated differently. Finally, whether you have already started the internal complaints process affects which escalation route is currently open to you. If you can set out that timeline, the advice can be made much more precise.

Bottom line

Losing your login is not the same as losing your evidence and does not remove your rights. Move quickly to put the university on notice to preserve records, make a subject access request that does not depend on account access, and ask the complaints office directly for the documents relevant to your case. If material has been improperly destroyed, document that carefully, because it may help rather than harm your complaint, and use the OIA and the ICO as the respective external backstops.