GDPR: Making a subject access request

Under data protection legislation an individual has the right, subject to certain exemptions, to access the personal information that an organisation holds about them. Accessing personal data in this way is known as making a subject access request.

Subject access requests are different to requests submitted under FOI legislation, which relate to information about the organisation itself.

If you wish to make a subject access request to the Homerton College, your request must be made in writing.

Before we can act on your request, we must:

  • be sure of your identity
  • be supplied with information from you in order to locate the information you seek

You are entitled:

  • to be informed whether your personal data is being processed by Homerton College
  • to have the information constituting the personal data communicated to you in a permanent form (usually, this means paper copies)
  • to be given a summary of the sources, recipients and purposes of the processing

You may apply to access your data in writing in any way you choose.  A Subject Access Request Form is made available for your convenience. The form sets out where you should send your request what proof of identity we require.

On receipt of your completed request, verification of your identity, and sufficient details to enable us to locate the information, the College is obliged to respond within 30 calendar days. The information will be supplied subject to any applicable exemptions. The data will be provided as of the date of receipt of your request.

If you have any reason to believe that the Homerton College has not dealt correctly with your request, please contact data.protection@admin.cam.ac.uk. If you are still not satisfied, you should contact the Information Commissioner's Office at https://ico.org.uk/concerns/