Making a Subject Access Request

Under the General Data Protection Regulation (GDPR) an individual has the right, subject to certain exemptions, to access information from organisations that process their personal data. The process for obtaining this information is known as a subject access request. (Subject access requests are different to requests submitted under FOI legislation, which relate to information about the organisation itself.) 

If you wish to make a subject access request to Cambridge Enterprise, your request must be made in writing (this may be in electronic form). 

Before we can act on your request, we must be sure of your identity. 

You are entitled: 

  • to be informed whether your personal data is being processed by Cambridge Enterprise; 
  • to have the information constituting the personal data communicated to you in a permanent form.  If your subject access request is made electronically, the information will be provided in a commonly used electronic format, unless you agree to receive it in some other way; 
  • to be given the purposes of the processing and the categories of personal data concerned; 
  • to be given details of the recipients to whom the data has been or will be disclosed, including recipients in countries outside the European Economic Area and the appropriate safeguards relating to such data transfers; 
  • to be informed about the length of time the data will be stored, or how that period is determined; 
  • to be informed about any third-party sources of the data, and where this information is available; and 
  • to request the rectification or erasure of data, the restriction of processing and to object to processing. 

You may apply to access your data in writing in any way you choose. A Subject Access Request Form is made available for your convenience. The form sets out where you should send your request. 

Under the GDPR, the time limit for responding to a subject access request is one month from the date of receipt. However, if a request is complex, we have the right to extend the time period for response by a further two months. 

If you have any reason to believe that Cambridge Enterprise has not dealt correctly with your request, please contact and mark your email ‘Data Protection Matter’. If you are still not satisfied, you should contact the Information Commissioner’s Office.