Right to know source of personal data

Yes, in most cases you can. Under data protection law in England and Wales you have two overlapping rights that can require your university to tell you where it got your personal information.

The legal basis

Your university is a data controller under the UK GDPR and the Data Protection Act 2018. Two provisions are relevant.

First, the right of access under Article 15 of the UK GDPR. When you make a subject access request, you are entitled not only to a copy of your personal data but also to certain supplementary information. Article 15(1)(g) specifically entitles you to “where the personal data are not collected from the data subject, any available information as to their source.” So if the university holds information about you that it obtained from somewhere other than you, you can ask for it, and it must tell you the source so far as that information is available to it.

Second, the right to be informed under Article 14. Where a controller obtains personal data about you from a source other than you, it must proactively give you privacy information, including the source of the data and, where relevant, whether it came from a publicly accessible source. It normally has to do this within a reasonable period and at the latest within one month of obtaining the data, or when it first contacts you or discloses your data. This is a duty on the university to tell you even without a request, though in practice it is usually satisfied by a privacy notice.

Important limits and qualifications

The Article 15 right is to “any available information” as to the source. If the university genuinely did not record where a particular item came from, it can only tell you what it actually holds. It is not obliged to create or reconstruct information it does not have.

The obligation to identify the source is not absolute. Data protection law has to be balanced against the rights and freedoms of others. If revealing the source would identify another individual, for example a person who supplied information about you, the university can withhold that identity unless the other person has consented or it is reasonable to disclose without consent. This third party data exemption is a common reason for a source not being named in full.

There are also other exemptions in the Data Protection Act 2018 that may apply, for example where the information relates to certain confidential references, legal advice, management planning, or where disclosure would prejudice an ongoing investigation. In a university context, confidential references and internal disciplinary or safeguarding material are the areas where an exemption is most likely to be argued.

The right to be informed under Article 14 also has exceptions, notably where providing the information would involve disproportionate effort, or where you already have the information, or where a legal professional secrecy or confidentiality obligation applies.

How to make the request in practice

1. Put the request in writing to the university, ideally to its data protection officer, whose contact details will be in the university privacy notice. Any university will have a DPO.

2. Make clear you are exercising your right of access under Article 15 of the UK GDPR, that you want a copy of your personal data, and that you specifically want the supplementary information under Article 15(1)(g), namely any available information as to the source of data not collected from you.

3. Identify the data as precisely as you can. If you are really only interested in the origin of one particular piece of information, say so. A focused request is more likely to get a quick, useful answer than a blanket request for everything.

4. Provide enough information for the university to identify you and locate the data, for example your student number and the relevant dates or context.

There is normally no fee. The university must respond without undue delay and within one month, which it can extend by up to a further two months if the request is complex or you have made several requests, but it must tell you within the first month if it is extending and why.

What to do if the university refuses or gives an inadequate answer

If the university does not identify the source, first ask it to explain, in writing, whether it holds the information at all and, if it is relying on an exemption, which exemption and why. Controllers should be able to justify a refusal.

If you are not satisfied with the response, you can use the university’s internal complaints procedure and then complain to the Information Commissioner’s Office, which regulates data protection compliance. The ICO can investigate and, if appropriate, require the university to comply.

You also have the option of enforcing your rights through the courts under section 167 of the Data Protection Act 2018, which can order a controller to comply with an access request, but this is usually a last resort given cost and effort. Compensation under section 168 is only available where you have suffered damage or distress, so litigation is rarely worthwhile purely to discover a source.

Points that could change the answer

The outcome depends on a few facts. If the information about you actually came from you, Article 15(1)(g) does not apply, though you can still get a copy of the data itself. If the source is another identifiable individual, expect the identity to be redacted or withheld unless disclosure is reasonable. If the data engages a specific statutory exemption, the university may lawfully decline to reveal some or all of it. And the practical strength of your request improves considerably if you can explain why the origin of the information matters, for example because it appears in a disciplinary decision, a reference, or an admissions or fitness to study process, since that helps the university and, if needed, the ICO to assess whether withholding the source is fair.