Data Protection

Reporting a data security incident 

If you suspect that a data breach security incident involving personal information held by the University has occurred, please complete our Data Security Incident Form as soon as possible. 

Data Security Incident form

Data protection at York St John University

The following documents set out the University's obligations and approach:

• Applicant Data Protection Statement (PDF, 0.1MB)
• York St John Data Protection Policy (PDF, 0.1MB)
• Student Data Protection Statement (PDF, 0.1MB)
• Acceptable Use Policy for University ICT systems
• Privacy Notice for Lecture Capture (PDF, 0.1 MB)
• YSJU Freedom of Information Policy (PDF, 0.2MB)
• YSJU Data Retention Erasure Policy (PDF, 0.2MB)
• YSJU Subject Access Request Policy (PDF, 0.2 MB)

Staff can find additional information and resources on the Staff Intranet.

Higher Education Statistics Agency (HESA) collection notices

Access the Higher Education Statistics Agency Student & Staff Collection Notices for 2020/21.

Request access to your personal data

You have the right to request access to your personal data held by York St John University.

Article 15 of the General Data Protection Regulation gives you the right to:

• Confirmation that your personal data is being processed
• Access to your personal data
• Access to supplementary information (as specified in Article 15).

Making a request

You can request this information by emailing gov.compliance@yorksj.ac.uk or by writing to:

University Secretary and Registrar
York St John University
Lord Mayor’s Walk
York YO31 7EX

Your written request should include:

• Your full name
• Your address
• A description of the information that you want to access
• The capacity in which you believe we hold the information (for example as a employee, student, or applicant)

Making a request is usually free but the University reserves the right to make charges within the parameters of data protection legislation.

For more information please see the Information Commissioner's Office's guidelines.

Responding to a request

On receiving your request, the University will take reasonable steps to verify your identity. We may need to ask you for more information to find the personal data covered by your request.

We are obliged to reply promptly to your request and within one calendar month at the latest (beginning on the day the we receives your request.)

If we need additional information to identify and find the information you wish to access we will inform you promptly.

Data collection for Association to Advance Collegiate Schools of Business (AACSB) accreditation

AACSB accreditation is known worldwide, as the longest-standing, most recognized form of specialized accreditation that an institution and its business programs can earn.

Accreditation is a voluntary, nongovernmental process that includes a rigorous external review of a school's mission, faculty qualifications, curricula, and ability to provide the highest-quality programs.

To find out about how York St John collect, use, store and share your data and details, download our GDPR data collection statement (Docx, 38.5kB).

Contact us

The University's Data Protection Officer is the University Secretary and Registrar, who can be contacted by emailing us@yorksj.ac.uk or by putting your request in writing to the address below.

University Secretary and Registrar
York St John University
Lord Mayor’s Walk
York YO31 7EX

Please see the Information Commissioner's Office website for further information related to your rights under the General Data Protection Regulation and Data Protection Act 2018.