Data Protection & Freedom of Information Office

Retention of information relating to FoISA compliance

Requests for information that are published or routinely provided by the University of Glasgow will be handled in accordance with standard University procedures and detailed records of the correspondence will not be retained. Only non-routine requests for information received by the University will be dealt with by the Data Protection and Freedom of Information Office, and these will be incorporated into monthly statistics generated by the Office.

For requests for information that the University of Glasgow does not publish, the Office will create a single case record for each request. A single case record will also be created for each Request for Review and Appeal to the Scottish Information Commissioner. These case records will contain, as applicable:

• Correspondence between the University and the applicant
• The response to the applicant including details of any information withheld and what exemptions/exceptions were applied
• Correspondence between the University and the Scottish Information Commissioner
• Information on actions and decisions taken with regard to the Request for Information
• Information on actions and decisions taken with regard to the Request for Review
• Information on actions and decisions taken with regard to an Appeal to the Scottish Information Commissioner

Each case record is likely to contain personal data as defined in the General Data Protection Regulation. Specifically, each record is likely to contain:

• The name, address, and other contact information of the applicant
• Personal details provided by the applicant when making his/her request
• Where a fee has been paid, bank account and other payment details
• All personal data will be handled with care and in accordance with the General Data Protection Regulation. Access to personal data will be strictly controlled.

The standard case file retention period will be end of calendar year when the case was raised, plus two years. In very rare cases the University may retain particularly lengthy or complex requests for a longer period of time - particularly where (a) the applicant has requested a Review of the University’s original actions and decisions, and (b) the case resulted in an Appeal to the Scottish Information Commissioner. Case records may be stored either in the Data Protection and Freedom of Information Office or in the University Records Centre.