Making a Subject Access Request

Subject access requests

Under data protection legislation an individual has the right to access the information that an organisation holds about them. Accessing personal data in this way is known as making a subject access request.  (Subject access requests are different to requests submitted under FOI legislation, which relate to information about the organisation itself.)

You are entitled:

  • to be informed whether your personal data are being processed by the University of Cambridge
  • to be sent a copy of your personal data (normally as of the date of receipt of your request), subject to any applicable exemptions and the removal of other people's personal data as appropriate
  • to be sent certain information about your personal data

Your subject access request to the University may be submitted in whatever format you wish, but we have created a standard Subject Access Request Form for your convenience, which may be completed and emailed to data.protection@admin.cam.ac.uk.  Using the form will help us to verify your identity and give a timely and accurate response to your request.  There is no charge to make a subject access request.

On receipt of your request, we will let you know the statutory deadline by which we will reply. If, on receipt of our response, you consider that the University has not dealt correctly with your request, please email data.protection@admin.cam.ac.uk. If you are still not satisfied, you should contact the Information Commissioner's Office.

 

Exercising other data protection rights

Under data protection legislation an individual has various other rights.  These rights requests may be submitted in whatever format you wish, but we recommend that you email data.protection@admin.cam.ac.uk to ensure a timely response to your request.

Please try to be as specific as possible about what personal data you are asking to be rectified, erased, restricted or ported, or the nature of your objection.  As with subject access requests, it helps to attach a picture/scan of one form of photo ID to enable us to swiftly verify your identity.

 

How we use your personal information to handle your data protection rights request

The Information Compliance Office will use your personal information to log, consider and answer your data protection rights request to the University, as well as to verify your identity.  We will liaise with colleagues internally (including those with access to or otherwise responsible for the personal data in question) as well as, where applicable and necessary, external advisors and/or third party individuals whose personal data may be intermingled with your own.  From time to time we analyse requests to look for trends or collate statistics.  If you pursue a complaint to the ICO and/or the courts, we will share your information as necessary in answering regulatory enquiries and making submissions.

These uses of your personal information are necessary to fulfil our legal obligations and public interest tasks in handling such requests.

For more information about how we handle your personal information, and your rights under data protection legislation, please see https://www.information-compliance.admin.cam.ac.uk/data-protection/general-data.