Data Protection

All personal information gathered and held by York St John University is treated with the care and confidentiality required by the data protection legislation (the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR); Data Protection Act 2018).

The following documents set out the University's obligations and approach:

Staff can find additional information and resources on the Records Management Framework moodle page.

Subject Access Request Procedure

Article 15 of the General Data Protection Regulation gives individuals a general right to request access to personal data held about them by the University. Specifically, individuals have the right to:

  • confirmation that their personal data is being processed;
  • access to their personal data; and
  • supplementary information – as specified in Article 15.

You can request information on the personal data we hold about you at any time by emailing or by putting your request in writing to:

The University Secretary

York St John University

Lord Mayor’s Walk

York YO31 7EX


Your written request should include:

  • your full name
  • address
  • description of the information that you seek and the capacity in which you believe the University holds the information (e.g., employee; student; applicant).

On receiving your request, the University will take reasonable steps to verify your identity; or we may need to ask you for more information to find the personal data covered by your request.


There is usually no charge for this service although the University reserves the right to make charges within the parameters of data protection legislation.

We are obliged to reply promptly to your request and in any event within one calendar month (beginning on the day the University receives your request).

If we need additional information in order to identify and locate the information you wish to access we will inform you promptly.

For general information about submitting a Subject Access Request, please see the ICO's guidelines at

Data Security Breaches

If you suspect that a data beach involving personal information held by the University has occurred, please complete the Data Security Breach Form as soon as possible.

The University's Data Protection Officer is the University Secretary, who can be contacted by emailing or by putting your request in writing to the address below.

The University Secretary

York St John University

Lord Mayor’s Walk

York YO31 7EX


Please see the Information Commissioner's Office website for further information related to your rights under the General Data Protection Regulation and Data Protection Act 2018.

Cookie Settings