Receiving a request for information - What to do

There are two types of information a person may request from the University; personal or general. It is important that both types of requests are dealt with quickly as the University has a limited time frame to respond.

  1. Any request relating to an individual, whether made by that individual or by a third party, is a request for personal information and is dealt with under the General Data Protection Regulations / Data Protection Act 2018, either as a Subject Access Request or a third party request.
  2. A request for information in general, which doesn’t focus on an individual, is dealt with as a request under the Freedom of Information Act

Freedom of Information (FOI)

Time limit: 20 working days from the date of receipt.

Forward to:

A person does not need to refer to the Freedom of Information Act within their request for it to be dealt with under the Act, any written request for general information from the University can be responded to as an FOI.

The requester must provide their name and either a valid email address or a postal address, but they do not need to state a reason for their request, nor provide proof of identity. A request may sometimes seem obscure, 'silly', or commercially speculative in nature, but this in no way automatically invalidates the request.

For the purposes of FOI the University must be 'applicant and motive blind' and consider each request without reference to, or speculation of, the identity or motives of the requester. The focus is instead on whether the information is suitable for disclosure into the public domain, as every disclosure under FOIA is considered a disclosure to the public at large. This means that regardless of whether the requester is a known or suspected journalist, MP, researcher etc., they will receive the same response as any other person who might make an identical request. 

Please forward requests and any queries to for central processing.

Exemptions to release of data

There are occasions when it is not appropriate to release the information that has been requested, in these cases two types of exemption can be applied, absolute and non-absolute. Non-absolute exemptions may only be applied once the University has considered the public interest test and found that withholding the information weighs more heavily in the public interest than does releasing it.


Absolute Exemptions – public interest test does not apply

Section of the FOI Act


S(2) 21

Information accessible by other means (e.g. online)

S(2) 23

Information supplied by, or relating to, bodies dealing with security matters

S(2) 32

Court records, and information held in relation to court proceedings

S(2) 40

Personal information

S(2) 41

Information provided in confidence

S(2) 44

Information whereby disclosure is prohibited by an enactment or would constitute contempt of court 


 Qualified Exemptions – public interest test applies

Section of the FOI Act


S(2) 22

Information intended for future publication

S(2) 30

Investigations and proceedings conducted by public authorities

S(2) 31

Law enforcement

S(2) 36

Prejudice to effective conduct of public affairs (requires the VC’s opinion as the 'qualified person')

S(2) 38

Health and Safety

S(2) 39

Environmental Information

S(2) 40

Personal Information relating to a third party 

S(2) 42

Legal professional privilege

S(2) 43

Commercial interests


Examples of Requests and Responses



How many students enrolled on a Computer Science degree in each year from 2013/14 to 2016/17? Please break these down by each individual’s age, gender and ethnicity.


Partial disclosure of information would occur in this instance.

Numbers of students in each year would be supplied, but line by line detail of each individual’s age, gender and ethnicity would be withheld under Section 40 of the FOIA, as taken altogether this could identify individuals. Instead, a summary of each category would be provided.


How many assignment extensions were granted to students between 2005 and 2010?

This information would be fully withheld under Section 12 of the FOIA, as due to the lack of centrally held records, compiling the data from individual files would exceed the ‘appropriate limit’, which equates to 18 hours of staff time.


How many places are you offering/hoping to fill in the next academic year for learning disability nursing pre-registration students?




This information would be fully withheld under Section 43 of the FOIA as it is commercially sensitive information. If made public, the University’s student intake budgets could be used by other providers to gain an unfair competitive advantage.


Please provide the start and end date of your contract for waste and recycling.





This information would be provided without exemption.



Further Information

Information Commissioner's Office Freedom Of Information Guidance.

Information Commissioner's Office Environmental Information Regulations Guidance.

Keele University's Freedom of Information Policy.


Subject Access Request (SAR)

Time limit: 30 calendar days.

Forward to:

Under Article 15 of the GDPR individuals have the right to make a Subject Access Request to the University, usually free of charge, for their own personal data, being the subject of that data. In rare cases where a request is found to be "manifestly unfounded or excessive" we may charge a “reasonable fee” for administrative costs. 

For any such requests please notify the Governance team via email to so that it can be duly processed.

Example Requests

  • A student requesting a copy of any internal emails that include their name or student number.
  • A member of staff requesting a copy of their entire employee record.
  • A solicitor acting on behalf of their client, a current student, via signed authority requesting all information held by the University. 

Steps must be taken in order to verify a person’s identity or their right to act on another’s behalf before any data is collated. Often several different sections of the University need to be contacted in order to capture all relevant information, which must then be thoroughly checked and redacted where any personal details of third parties are included. 

In the case that a document made by a third party refers to the subject, the rights of the third party must be considered alongside those of the subject requesting the data. For example, a member of staff requests a copy of a complaint made against them by another member of staff. As this written complaint contains details of the requester, it can be considered their personal data, however, it is also the personal data of the complainant. The impact upon the third party of releasing this data must be assessed before a decision to release or withhold is made. 

It is an offence to knowingly withhold or destroy someone’s personal data following a request.

Third Party Requests

Forward to:

A third party, such as the Police or a Tax Officer, may make a request for a person’s information. These requests may be phrased in a very urgent manner but their origin does not mean that the University will automatically disclose someone’s personal information, even to the Police. 

Please forward all third party requests to to be processed centrally.

Example Third Party Requests

  • A Police Officer requesting the contact details of a former student in relation to a crime.
  • A Tax Officer requesting the employment history of an employee in relation to an investigation of fraud. 
  • The General Pharmaceutical Council ask for copies of all information held in relation to a Pharmacy student's academic conduct.

All Police requests must be received on the appropriate form, which is produced by the Police themselves. Other agencies may also have their own forms but the University will provide one if necessary. The Data Protection Act provides exemptions for the processing of personal data for any of the following purposes: 

  1. The prevention or detection of crime
  2. The apprehension or prosecution of offenders
  3. The assessment or collection of any tax or duty or of any imposition of a similar nature 

Should you receive such a request via telephone or in person at your office, please remind the requester to submit the appropriate form in all cases. Telephone a member of the Legal & Information Compliance team if a request is of an exceptionally urgent nature.

There are additional exemptions that third parties can ask the University to consider releasing personal data under, though these are less common. Each request must be considered on its own merits, as these are not blanket exemptions and the University must satisfy itself that an exemption applies and release is appropriate.

Before the release of any data, all information must be thoroughly checked and redacted where necessary.

It is an offence to knowingly withhold or destroy someone’s personal data following a request.