University charging for subject access request

Short answer

Yes, but only within narrow limits, and a university cannot use “excessive” or “unfounded” simply because responding is inconvenient or because it dislikes the request. Under the UK GDPR (as supplemented by the Data Protection Act 2018) an individual has the right to make a subject access request (SAR) and, in most cases, to receive their personal data free of charge within one month. A university acting as a data controller can only refuse, charge for, or partially comply with a SAR where it can genuinely show the request is manifestly unfounded or excessive. The Information Commissioner’s Office (ICO) treats this as a high threshold, and the burden is on the university to justify its decision.

The default position

The starting point is that a SAR is free and must be answered within one month of receipt (which can be extended by up to a further two months where the request is complex or you have made a number of requests). The university must confirm whether it is processing your personal data, provide a copy of that data, and give the supplementary information required by Article 15 UK GDPR, such as the purposes of processing, recipients and retention periods.

A university holds a wide range of personal data about students, applicants and staff, for example academic records, assessment and marking records, disciplinary and misconduct files, emails mentioning you, references, complaints correspondence and CCTV. All of this can in principle fall within a SAR.

When can it refuse or charge?

The only route to refusing outright, or to charging a reasonable fee, is if the university can show the request is:

1. manifestly unfounded; or
2. excessive; or
3. both.

If one of these applies, the university has a choice. It can either refuse to comply (wholly or partly), or it can comply but charge a reasonable fee based on the administrative costs of dealing with the request. It cannot do both for the same work, and it must explain its reasoning to you.

What “manifestly unfounded” means

This concerns your motive and conduct, not the size of the request. The ICO indicates a request may be manifestly unfounded where, for example, you clearly have no genuine intention to exercise your right of access, or where you are using the request to harass the organisation with no real purpose behind it, for instance by making the same request repeatedly with an explicit intention to cause disruption, or by making unsubstantiated accusations and offering to withdraw the request in return for some benefit.

Importantly, the word “manifestly” means it must be obvious or clear. The university cannot presume a request is unfounded just because you are in dispute with it, have complained, are pursuing a grievance or academic appeal, or intend to use the information in litigation or a complaint. A collateral purpose such as gathering evidence for a claim does not, by itself, make a SAR unfounded. Each request should be considered on its own merits.

What “excessive” means

A request is not excessive simply because you have asked for a large amount of information. The ICO’s position is that you can ask for everything the organisation holds about you, and volume alone does not make a request excessive. Whether a request is excessive depends on all the circumstances, including the nature of the data, the difficulty and cost of retrieval, and whether the request repeats one you have already answered without a reasonable interval having passed.

A university is entitled to ask you to specify or narrow the information you want where it processes a large quantity of data about you. That is a request for clarification, not a refusal, and while awaiting a reasonable clarification the time limit can be paused. But it cannot force you to narrow a request as a condition of complying, and refusing to narrow does not automatically make the request excessive.

Fees and “further copies”

Separately from the excessive or unfounded route, the university can charge a reasonable fee, based on administrative cost, if you ask for further copies of information already provided. It can also charge a reasonable fee for extra administrative costs where the request is manifestly unfounded or excessive. Any fee must be limited to reasonable administrative costs and the university should explain how it is calculated. It cannot charge a flat or arbitrary fee, and it cannot charge for a normal, single, genuine SAR.

Burden of proof and how a refusal should be handled

The responsibility to demonstrate that a request is manifestly unfounded or excessive rests firmly on the university. If it refuses or seeks to charge, it must, without undue delay and at the latest within one month, tell you the reasons, that you can complain to the ICO, and that you can seek a judicial remedy. A bare assertion that the request is “excessive” without genuine analysis is unlikely to satisfy the ICO.

Practical next steps if you think the university is wrong

1. Keep your SAR in writing and dated, and keep proof of when you sent it, so the one-month clock is clear.

2. If the university claims the request is excessive, consider whether you can reasonably identify categories, date ranges, custodians or systems. Offering focus can get you the core material faster while preserving your right to the rest, and it removes the university’s main argument.

3. If it refuses or demands a fee you think is unjustified, ask in writing for its specific reasons and, where a fee is claimed, a breakdown of the administrative costs. Point out that the threshold is high and that the burden is on the controller.

4. Escalate internally to the university’s Data Protection Officer, who most universities are legally required to have, before treating the refusal as final.

5. If you remain dissatisfied, you can complain to the ICO, which can investigate and issue a decision or take enforcement action. You can also enforce the right of access through the courts under section 167 of the Data Protection Act 2018, and claim compensation under section 168 where you have suffered damage, though litigation carries cost and risk and is usually a last resort.

Points to bear in mind

Some information may be legitimately withheld under exemptions even where the SAR itself is valid, for example where it contains the personal data of other people who have not consented and it would be unreasonable to disclose it, references given in confidence, information subject to legal professional privilege, or exam scripts (which are exempt as your own answers, although examiners’ comments on your performance are generally disclosable). A university relying on such exemptions should still respond to the parts it can disclose. That is different from refusing the whole request as unfounded or excessive.

If you tell me exactly what the university has said, whether it has cited a fee or a refusal, what data you asked for and how, and whether there is an ongoing dispute, appeal or complaint in the background, I can assess whether its stated grounds are likely to stand up and help you frame a response.