You can ask a study app or university for personal information it holds about you. You can also request deletion or object to some uses, but those rights have conditions. They do not give you ownership of every lecture recording, or an automatic right to move every AI-generated file between services.
For a UK student, the useful starting point is the outcome you need: a copy of your records, correction of a problem, removal of an unnecessary file, or a clear explanation of where an upload goes.
Choose the right request
| What you need | Relevant route | Limit to understand |
|---|---|---|
| Personal information held about you | Subject access request, or SAR | Exemptions and other people’s rights can affect disclosure |
| Removal of personal information | Erasure request | Some information may need to be retained |
| Data transferred in a reusable format | Portability request | Applies to qualifying data you provided, not every generated output |
| An end to certain uses | Objection | The outcome depends on the basis and purpose of processing |
| A downloadable set of revision notes | Product export | This may solve your immediate need without being a complete legal access response |
The ICO’s access guide explains that you may ask whether an organisation uses or stores your personal information and request copies. You can ask for all of it, but identifying the records and dates you need can produce a more useful answer. A request does not necessarily entitle you to an unredacted document containing information about other people.
A useful request is specific, not legalistic
For example, if an app has attached someone else’s transcript to your account, identify the recording title, date and account email. Explain that you want information associated with that incident, and how it was used. Do not forward the entire misplaced transcript to unrelated support channels.
For a university record, identify the relevant module, academic year and office. If your concern is a contribution in a lecture recording, the session date and timestamp can help the lecturer locate it. Ask about the institution’s procedure for reviewing that contribution.
You can submit a SAR online, by email, post, phone or in person. The ICO recommends keeping records; for a web form, save a screenshot before submission. Using the published privacy contact can help route the request, but a special subject line is not what creates your right.
Keep the acknowledgement, your original request and any follow-up. Provide enough information to identify your records, without sending unnecessary identity documents to an unverified address.
Understand the response clock
The normal response period is one month. Under the changes made by the Data (Use and Access) Act 2025, identity verification and a permitted fee can affect when the clock starts. An organisation may pause a SAR while awaiting clarification that it can show is reasonably required. Complex or numerous requests can also justify an extension of up to two further months.
This does not mean every vague request automatically stops the clock. If clarification is requested, respond with the detail you can supply and keep the organisation’s explanation of the revised deadline. The Act also limits searches to what is reasonable and proportionate; it does not turn a broad request into permission to ignore it.
Generated notes are not automatically portable data
The ICO’s portability guidance limits this right to personal data you provided, processed automatically on consent or contract grounds. It includes some observed data, such as service-use history, but excludes additional information inferred or derived by the organisation. Derived information that is personal data can still be relevant to an access request.
That distinction matters for AI notes. Uploading a recording does not mean every summary generated from it is legally treated as data you supplied. Nor is every explanation of a course topic personal information about you.
Check the app’s actual export options before relying on portability to move your revision material. Download a small sample, open it in the software you intend to use, and confirm that headings, equations and references remain readable. An export feature can be valuable even where Article 20 does not require that exact file.
Deletion and objection have limits
The right to erasure applies in specified circumstances, for example where information is no longer needed for its original purpose. An organisation may need to retain some records for legal obligations, public tasks or legal claims. Asking to close a study-app account does not establish that every associated transaction record must disappear immediately.
Before deleting anything, save the material you still need. Then identify the files or account involved and ask what will be removed, what will remain and why. If deletion is refused, ask for the reason and the available complaint route.
The right to object concerns particular uses of personal information. Direct marketing has a stronger rule than many other purposes: an organisation cannot continue using your information for direct marketing after a valid objection. For other covered uses, it may be able to show grounds to continue. Read the stated purpose instead of assuming that every objection ends all processing.
Recording permission is a separate issue
A lecture can contain identifiable voices, names and personal disclosures. A transcript may preserve those details. The privacy rights you have over information about yourself do not authorise you to upload everyone else’s contributions.
University rules also differ. King’s College London’s Digital Education Policy permits personal audio recording with prior lecturer permission, with separate arrangements for students with a King’s Inclusion Plan. UCL’s 2026/27 policy ordinarily prohibits students from making their own teaching-session recordings, transcripts or translations, while providing accessibility arrangements and alternatives.
Check the relevant UK recording policy and whether it covers the external tool you want to use. If a university records a class, its notice should explain the purpose and basis: consent is not the only possible basis for processing, and the answer is not identical at every institution. Our lecture-capture guide explains the practical differences.
Check the whole journey of an upload
Storage in the UK or EU does not establish that all processing happens there. An app may store notes in one location while another company transcribes audio elsewhere.
The ICO’s transfer guide says a restricted transfer must be covered by adequacy regulations, appropriate safeguards or an applicable exception. Safeguards can include the UK International Data Transfer Agreement or the UK Addendum, with the required assessment. The transfer mechanism is only one part of wider compliance.
For a US recipient, the UK Extension to the Data Privacy Framework is limited to eligible businesses with active certification that covers the UK Extension and the relevant data types. Being a US company, or participating only in the EU arrangement, is not enough. A policy saying “standard contractual clauses” also does not by itself explain every applicable UK transfer requirement.
When comparing apps, look for the operator, processing suppliers, countries, retention rules, training uses and privacy contact. If a placement, research project or disability-support arrangement requires an approved tool, check that requirement before uploading. The UK note-app comparison can help with study features, but it cannot approve a particular use for your institution.
Complain about an unresolved problem
Raise the issue with the organisation and keep the correspondence. Since 19 June 2026, organisations must offer a complaints process, acknowledge a data-protection complaint within 30 days, investigate appropriately and communicate the outcome, as the ICO’s commencement notice explains. Acknowledgement is not the same as completing the investigation. If the problem remains unresolved, follow the ICO’s complaint guidance.
Where Notibo fits
Notibo stores application data in Frankfurt in the EU. Transcription and AI-note processing use US-based providers under standard contractual clauses. Raw audio is deleted after successful transcription; failed jobs may retain it temporarily for retry. Review the privacy policy and your course requirements before using it with teaching material.
For authorised material, Notibo produces editable transcripts and study notes that export as PDF or Word. Audio uploads have a 50 MB limit. Free includes 30 audio minutes per month; the 14-day Pro trial includes 240 minutes in total, with no card. Try a permitted sample and check the result before using it for revision.