Internal, open access


The Data Protection Act (DPA) provides two exemptions for certain examination-related information:

  • Examination scripts and the information contained in them do not have to be released under the DPA. However, examiners' comments are not covered by this exemption
  • Examination marks that have been requested before the results are announced have to be disclosed either within 5 months of the date of the request or within 40 days of the date the results are published, whichever is earlier. This prevents students from using the DPA to get their results before they are officially announced

However, in general, you should assume that, with the exception of those parts of the examination process that are specifically exempted by the DPA, all personal data produced and processed for the purpose of examinations and assessment may be obtained by a data subject via a subject access request.

The parts of the examination process that should be considered carefully with reference to the DPA include the following:

Examination scripts

Examination scripts, and other assessment work or field work, are expressly exempted from the normal data subject access rules by the DPA. This means that the University is under no obligation to permit examination candidates to have access either to their original scripts or copies of the scripts. However, it is the University's policy to ensure that feedback on performance in all work, including written examinations, is available to students. Schools are responsible for determining the nature and extent of feedback that is appropriate to the circumstances. This means that an appropriate member of academic staff may choose to permit a student sight of his or her script in order to discuss examination performance as described in the University's Examinations and Assessment Handbook and in more detail in in Section 6c of the University's Guide to policies and procedures for teaching and learning. A student may apply to see the examiner's comments on their examination paper by making a subject access request (as described in Accessing your personal data). The implications of this are described in the following section.

Internal examiners' comments

Internal examiners' comments, whether made on a script or in another form that allows them to be held and applied to the original script (for example, in a coded table) are covered by the DPA. A subject access request can be made to see a copy or a summary of these comments. Such a request can be made before the results have been announced, in which case, the time limit for disclosure is five months from the receipt of the request or 40 days after the announcement of the result, whichever is the earlier.

In view of the fact that comments can be accessed in this way, it is important to ensure that the comments are intelligible and appropriate and also that the comments can be easily produced if necessary.

The JISC Data Protection Code of Practice (PDF-3.68MB) recommends that universities should consider recording comments separately from the examination script or in another way that would enable them to be easily separated from the actual script in the event of a subject access request. For example, they could be recorded on a tear-off comments strip on the pages of the examination booklet.

Advice to markers is given in the University's Examinations and Assessment Handbook.

External examiners

External examiners' comments are covered by the DPA in exactly the same way as internal examiners' comments. Therefore, it is important that the external examiner fully understands the rights and responsibilities associated with the role. The standard nomination form and appointment letter used by University when appointing external examiners provide the appropriate data protection statement.

Display of results

As a general guide, examination results are personal data and should not be disclosed to third parties without the data subject's consent. During the online enrolment process students of the University of Reading give their consent for the University to process their personal data for various uses as described in the Students' Fair Processing Notice (FPN). This section includes a statement that their examination results may be posted on notice boards within the University. Therefore, it is permissible to display results in this way. However, students do have a right to request that their results are not displayed; they should write to the Data Protection Officer via the IMPS Office to exercise this right, if necessary. The display of results in this way applies only to overall results but not to individual marks.

It is also possible to list names and results on a School's Blackboard site, assuming that such a listing would be available only to course members. Again, this applies to overall results rather than individual marks.

Results will also be available in a Reading Integrated Student Information System (RISIS) portal via the normal login route.

According to the DPA, the University must not do any of the following:

  • display examination results outside the local area, for example in national newspapers or on the internet, without explicit permission from the students concerned
  • disclose results over the telephone without the explicit permission of the student
  • withhold results from students who are in financial arrears. However, providing results is not the same as awarding a degree or other qualification.

As stated in the Students' Fair Processing Notice (FPN), the University considers that awards made are in the public domain and so some Schools pass a list of degrees awarded within the School to the appropriate professional bodies. This practice can continue within the DPA without the students' explicit consent provided the list includes only degrees awarded, not classifications or failures. The students should be informed in their programme handbook that this will happen so that they can opt out if necessary.

Examination board meetings minutes

The minutes of examination board meetings are subject to subject access request if they contain discussion about candidates identified by name or some sort of unique identifier, unless the data cannot be disclosed without additionally disclosing personal data about a third party. Usually, this can be avoided by redacting (editing) the third party data out of the minutes or by obtaining their consent to their personal data being disclosed. Requests to see the minutes of examination boards should be forwarded to the IMPS Office to ensure that they are handled appropriately.

Minutes of special circumstance committees and examination appeals panels are also subject to data subject access request in the same way.

Examination board minutes and related documentation that concern general discussions, for example, about moderation standards, will very likely be accessible to students under Freedom of Information Act(FOIA) legislation, unless an exemption can be claimed. Similarly, University policies and procedures including those relating to marks and appeals will be accessible under FOIA legislation.

Automatic processing

The DPA provides data subjects with specific rights to be informed of the logic of any purely automated decision that significantly affects them.

The University runs processes on the Reading Integrated Student Information System (RISIS) to calculate provisional progression outcomes and degree classifications for undergraduates. These outcomes are then checked by the Examinations Office, and approved by Programme and Faculty Examiners' Meetings before being released to students. The Framework for classification and progression for first degrees (PDF-105KB) explains how these outcomes are calculated.

Things to do now


  • Student Services

Contact IMPS

Report an

Find out if you need to do a DPIA here:

Page navigation


Search Form

A-Z lists