Subject Access Requests

Individuals have the right to make a subject access request. If an individual makes a subject access request, the organisation will tell him/her:

  • whether or not his/her data is processed and if so why, the categories of personal data concerned and the source of the data if it is not collected from the individual;
  • to whom his/her data is or may be disclosed, including to recipients located outside the European Economic Area (EEA) and the safeguards that apply to such transfers;
  • for how long his/her personal data is stored (or how that period is decided);
  • his/her rights to rectification or erasure of data, or to restrict or object to processing;
  • his/her right to complain to the Information Commissioner if he/she thinks the organisation has failed to comply with his/her data protection rights; and
  • whether or not the organisation carries out automated decision-making and the logic involved in any such decision-making.

How to make a subject access request

To make a subject access request, the individual should send the request to The email title should state that it is a SUBJECT ACCESS REQUEST.

EMC the organisation will need to ask for proof of identification before the request can be processed. The organisation will inform the individual of documents it requires to verify identity.

EMC will normally respond to a request within a period of one month from the date it is received.  

Subject Access Requests will be free of charge unless there is a lot of work or a lot of photocopying and postage, which we are allowed to charge a reasonable fee for.


You can also ask us to:

  • correct your data if you think it is wrong (Right to Rectification);
  • erase your personal data in certain circumstances (Right to Erasure);
  • stop using your data if you think it is wrong or we shouldn’t have it, until it’s put right or deleted (Right to Restriction);
  • stop using your data if you think we no longer should be using it (Right to Object);
  • transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated (Right to Data Portability);
  • consider any complaint you have about how we have used your data.