Making a Subject Access Request for yourself
Under the terms of the UK General Data Protection Regulation (UK GDPR) you may ask the College for any information it processes about you as an individual.
Please note the College will normally have a month from receipt to respond to your request. However, if your request is complex, the College may require additional time to provide a response.
A subject access request can be made verbally or in writing to the College. It is advised to use the 'Subject Access Form' and send it to the College Data Protection Lead, to ensure your request is dealt with correctly.
To help us to identify you and to locate any personal information the College may hold about you more quickly, it is advised to include the following information in your request:
- Your current full name and any alternative names (e.g., matriculation name, maiden name)
- Date of birth
- Your current home address, email address and phone number
- If you have recently moved, include your previous address
- Your student number, employee number or Cambridge email address (if applicable)
Please ensure that you include one item of evidence of your identity from each group as listed below.
This is a mandatory requirement and without evidence of a proof of ID and a proof of address, there will be a delay in processing your request.
N.B. Scanned documents and photocopies of the specified documents will be sufficient.
Acceptable evidence types:
Proof of ID
- a birth certificate
- a driving license
- a passport
- a National ID card
If your name has changed since your time at Girton, please also include a copy of your marriage certificate, name change certificate (e.g., Deed Poll)
Proof of address
- a bank statement
- a utility bill
- a council tax bill
- a TV license
To help us identify the information that you require, please provide as much detail and try to be as specific as possible.
Examples of information:
- Your student or personnel file
- Your dates of study or employment
- Relevant dates or timeframes for the information requested
- The names of key personnel (e.g., your tutor or line manager) that you were in contact with at College
- Identify specific documents or files you want e.g., emails between 'A' and 'B'
- Reason for request
Tell us how would you like the information to be released to you.
The College can provide information in the following ways:
- Hard copy (by post)
- Encrypted electronic file via email
- Encrypted electronic file via an online portal
- Collect in person (hard copy or electronic file via USB)
Please ensure you sign and date the Request Form.
The application cannot be processed if the form is not signed and this will be sent back to you.
Making a Subject Access Request on behalf of someone else
An individual can make a subject access request on behalf of someone else, but only if they have permission to do so.
Please note the guidance below, which details the information that must be supplied to satisfy the College you are entitled to request and receive the personal information for someone else.
To help us to process your request, please ensure you provide us with the following details:
- Full name (person making the request)
- Address and/or email address
- Telephone number
- Relationship to the individual (e.g., family member, solicitor, friend)
- A form of ID (e.g., driving licence, passport)
Please provide one of the following types of written evidence, so that the College can verify you have the authority to request personal data on behalf of another person.
This is a mandatory requirement and without written authority there will be a delay in processing your request.
N.B. Scanned documents and photocopies of the specified documents will be sufficient.
Acceptable evidence types:
- A written letter of consent from the individual
- A Power of Attorney document
- Evidence of parental responsibility (e.g., birth certificate, adoption certificate)
Please complete the 'Subject Access Form' and follow the guidance provided for individuals requesting their own personal data (above).
Where a signature and date is required, please provide your own signature rather than that of the data subject.
Information not available using a Subject Access Request
The College is often asked for information which it does not hold or process. Examples of these queries are listed below.
Wherever possible, the College will direct you to the correct person, department or organisation to deal with your request.
The College based Counselling service, is a service provided by the University Counselling Service.
All records relating to your contact with the Counselling Service will be held by the University Counselling Service and not the College.
You will need to contact the University Counselling Service directly for access to your counselling records. The contact information will be available on their website:
https://www.studentsupport.cam.ac.uk/get-support/individual-counselling
Girton is a College within the University of Cambridge, and we work closely with the University on all matters of common interest affecting the education of students and the pursuit of scholarship and research.
Whilst there are some personal data held by both the College and the University, there is a great deal of personal information that the College does not hold nor have access to.
We will inform you as part of our response if we do not hold the information requested, and wherever possible, we will try to indicate who you may need to contact.
If you are aware that your request relates specifically to information held by another College or Department, you are advised to contact them directly, so that your request for information is not delayed.
Individuals are only entitled to their own personal data under the 'Right of Access'.
The College will not provide third party access to another individual's personal data, unless:
- the individual has written authority to act on someone's behalf (e.g., Power of Attorney or written validation/permission from the individual).
- the individual's personal data also relates to other people. N.B. This will be dependent on a thorough review before disclosure.
- the personal data is requested by the Police or other agencies, for the purposes of the prevention of or detection of crime, or the apprehension or prosecution of offenders.
All subject access requests are reviewed on an individual basis, and the rights of all individuals considered before any disclosures are made.