Guidance

Student Loans Company: Data Subject Rights

Updated 24 June 2026

Data subjects have a range of specific rights in relation to their personal data, that they can exercise under UK data protection legislation (also known as UK General Data Protection Regulation (GDPR) or Data Protection Act 2018 (DPA 2018).

There are eight fundamental data subject rights:

• The right to be informed;
• The right of access;
• The right to rectification;
• The right to erasure (also known as the right to be forgotten);
• The right to restrict processing;
• The right to data portability;
• The right to object; and
• Rights related to automated decision making including profiling.

Except for the right to be informed and rights relating to automated decision making and profiling, the Student Loans Company (SLC) has one month from receipt to respond to your request. This can be extended by a further two months if we consider the request to be complex. However we will notify you within one month of receipt if we need to extend the response time.

There are no charges applicable to these requests unless exceptional circumstances apply (please see the section “Manifestly Unfounded or Excessive” requests).

All requests can be made by:

• Writing to:

Subject Access Requests
Student Loans Company
Repayment Enablement, Infrastructure & Verification (4th Floor)
10 Clyde Place
Glasgow G5 8DF

• Emailing DSR_SLC@slc.co.uk
• Or contacting one of these numbers (depending on where you live):

England – 0300 1000607
Northern Ireland – 0300 1000077
Wales – 0300 2004050
Scotland – 0300 1000609

1. Right to be informed

You have a right to be informed about the collection and use of your personal data.

SLC provides customers, employees, and applicants with information including:

• the purposes for processing their personal data;
• the retention periods for that personal data; and
• who it will be shared with.

SLC accomplishes this through the use of Privacy Notices for customers, employees, and job applicants, which are regularly reviewed/updated.

SLC is obliged to bring any new uses of your personal data to your attention before we start any processing.

2. Right of access

You have a right to request a copy of your personal data held by SLC. You can request this by making a Data Subject Access Request (DSAR), which is also sometimes known as a Subject Access Request or SAR.

SLC provides a Data Subject Access Request Form for individuals to use. This form is designed to help you give as much detail as possible to aid us in locating the information being requested. Although it is not mandatory to use this form, its use may prevent us from having to ask you for more information and therefore allow us to complete your request as soon as possible.

Under the Equality Act 2010, reasonable adjustments will be made for those unable to submit a request in writing. In certain circumstances, the requester has the right to receive their information verbally. If you require a reasonable adjustment to be made, then please contact either Student Finance England or Student Finance Wales

3. Right to rectification

You have a right to have inaccurate personal data rectified and/or completed if it is incomplete. You must contact/notify SLC immediately if you notice your personal data is inaccurate, incomplete or if it has been changed. Please see Terms and conditions of student loans.

SLC may though refuse a request for rectification if we are satisfied that the data held is accurate. Should that be the case, then, we will inform you that we will not be amending the data and explain our decision. We will also place a note on the relevant system to indicate that you have challenged the accuracy of your data and your reason(s) for doing so.

If you want to check and/or update the personal data we hold about you, you can do this using SLC’s customer portal or by calling one of the numbers above. Please note that we may ask you for evidence to action certain updates.

4. Right to erasure

The right to erasure is also known as ‘the right to be forgotten’.

You have the right to request the erasure of your personal data if:

• the personal data is no longer necessary for the purpose for which it was originally collected;
• we are relying on your consent as our lawful basis for processing and you withdraw this consent;
• you object to the processing of your personal data and there is no overriding legitimate interest to continue this processing;
• we are processing your personal data for direct marketing purposes and you object to that processing; or
• we have processed your personal data unlawfully.

SLC may refuse a request for erasure if we are satisfied that the data held is in line with our Records Management Policy. Should that be the case, we will inform you that we will not be erasing your data and explain our decision.

5. Right to restrict processing

You have the right to request that processing of your personal data is restricted or suppressed by SLC in the following circumstances:

• you are contesting the accuracy of your personal data, and we are verifying the accuracy of the data;
• we have processed your personal data unlawfully;
• we no longer need your personal data, but you need us to keep it in order to establish, exercise or defend a legal claim; or
• you have objected to us processing your personal data and we are considering whether our legitimate interests override those of yours.

6. Right to data portability

You have a right to obtain and re-use your personal data for your own purposes across different services. This allows you to move, copy or transfer personal data easily from one Information Technology environment to another in a safe and secure way, without affecting its usability.

The right to data portability only applies:

• to personal data you have provided to SLC;
• where the processing is based on consent or for the performance of a contract; or
• when processing is carried out by automated means.

SLC will provide your personal data in a structured, commonly used and machine-readable format e.g., a CSV file. Machine readable means that the information is structured so that software can extract specific elements of the data. This will enable other organisations to use the data. If requested, SLC will transmit the data directly to another organisation if this is technically feasible.

7. Right to object

You have the right to object to the processing of your personal data in certain circumstances:

• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority;
• direct marketing; or
• processing for research purposes.

8. Rights in relation to automated decision making and profiling

You have a right to information about the reasoning behind any decisions taken by automated means, including profiling:

• you should be informed when an automated decision has been taken; and
• you can ask SLC to reconsider a decision taken by automated means.

You can exercise your rights in relation to automated decision-making and profiling by contacting the appropriate support team contacting the Student Loans Company

9. Manifestly unfounded or excessive requests

SLC reserves the right to refuse any request which we consider to be manifestly unfounded or excessive.

In such cases where we consider a request to fall into any of these categories, we may proceed with the request but charge a reasonable fee for its completion. Any reasonable fee will be based on the administrative costs of complying with the request. If SLC decides to charge a fee, then we will contact you within one month, and once we have received the fee, we will action your request as soon as possible.

SLC will always consider a request in its own context, including any unique circumstances, before confirming if it is rejected on the basis of being either unfounded or excessive.

10. Data subjects have additional rights under UK data protection legislation, including:

The right to withdraw consent

In the limited circumstances where you have provided consent to SLC for the processing of your personal data for a specific purpose, and consent is the Legal basis SLC are using to process of your personal data, you have the right to withdraw your consent for that specific purpose at any time.

To withdraw your consent, please contact one of the below numbers (depending on where you live):

• England – 0300 1000607
• Northern Ireland – 0300 1000077
• Wales – 0300 2004050
• Scotland – 0300 1000609

Once SLC has received notification that you have withdrawn your consent, we will no longer process your personal data for the purpose (s) you originally agreed to, unless we are required to do so by law, or we have another Legitimate Basis for doing so in law.

The right to complain

You have the right to make a complaint at any time to the Information Commission (the UK supervisory authority for data protection legislation), about the way SLC processes or has processed your personal data.

The Information Commission can be contacted by:

• Writing to:

Information Commission
4th Floor
No 3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL

• Calling 0303 123 1113
• Or visiting their website Information Commission