Making an Information and Personal Data Request Privacy Notice

What is the purpose and legal basis for processing?

Our purpose for processing your personal data is so we can fulfil your information request to us.

The legal basis for this is article 6(1)(C) of the GDPR, which relates to processing necessary to comply with a legal obligation to which we are subject.

If any of the information you provide us in relation to an information request contains special category data, such as health, religious or ethnic information the legal basis we rely on to process it is article 9(2)(g) of the GDPR, which also relates to our public task and the safeguarding of your fundamental rights, together with Schedule 1 part 2(6) of the DPA2018 which relates to a statutory purpose.

What do we need and why do we need it?

We need information from you to respond to you and to locate the information you are looking for. This enables us to comply with our legal obligations under the legislation we are subject to:

  • General Data Protection Regulations (2016)
  • Data Protection Act (2018)
  • Freedom of Information Act (2000)
  • Environmental Information Regulations (2004)

What we do with it?

When we receive a request from you, we’ll set up an electronic case file containing the details of your request. This normally includes your contact details and any other information you have given us. We’ll also store on this case file a copy of the information that falls within the scope of your request. 

If you are making a request about your personal data, or are acting on behalf of someone making such a request, then we’ll ask for information to satisfy us of your identity. If it’s relevant, we’ll also ask for information to show you have authority to act on someone else’s behalf.

We’ll use the information supplied to us to process your information request and check on the level of service we provide.

If the request is about information we have received from another organisation – regarding a contract for example – we’ll routinely consult the organisation/s concerned to seek their view on disclosure of the material.

We compile statistics showing information such as the number of requests we receive, but not in a form that identifies anyone.

How long do we keep it?

We keep the case file related to requests made under the Freedom of Information Act (2000) and the Environmental Information Regulations (2004)  for three years after the last interaction to deal with any follow up actions. 

Subject Access Requests (SAR)

The standard case record retention period for each SAR is two years after the last action relating to the SAR. In exceptional cases the University may retain lengthy, complex or multiple requests for a longer period of time . This is where (a) the applicant made a complaint about the handling of the SAR or (b) the case resulted in an investigation by the UK Information Commissioner.

Withdrawn Subject Access Requests (SAR)

The standard case record retention period for a SAR withdrawn the applicant, will be one month after the last action related to the SAR. The University may retain the case record for a withdrawn SAR for a longer period where the applicant made a SARs previously. 

What are your rights?

For more information on your rights, please see Your rights.

Do we use any data processors?

We do not use data processors for the above.

Who is the Data Controller?

CCCU is the data controller for this data. Contact details are as follows

Canterbury Christ Church University

Rochester House

St George’s Place




Contact details:

Further information about how CCCU processes personal data and your rights related to it, is in our Data Protection Policy at:

How do I make a Complaint?

If you have a complaint about the way CCCU handles your data, you can complain to the University’s Data Protection Officer.

The University Data Protection Officer is

Robert Melville

Assistant University Secretary

Canterbury Christ Church University

Rochester House

St George’s Place




Telephone: 01227 767700

How do I contact the Regulator?

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to make a complaint to the Information Commissioner’s Office. The contact details are:

The Information Commissioners Office

Wycliffe House

Water Lane




Telephone: 0303 123 1113



Connect with us

Last edited: 15/10/2019 09:03:00