Subject Access Request to OCR

The organisation has renamed itself. OCR now trades as Cambridge OCR across its whole site, and its terms say "Cambridge OCR's sole member is the University of Cambridge … whose registered office is Cambridge OCR, The Triangle Building, Shaftesbury Road, Cambridge CB2 8EA" and that "Cambridge OCR is part of Cambridge University Press & Assessment". It is still its own legal person with its own ICO registration, Z6081006, at that address — separate from the University of Cambridge's. Requests are handled by the Cambridge University Press & Assessment Privacy Team. Your school or college is a separate data controller, and a request to one does not reach the other. OCR's data sharing agreement with every exam centre says the parties share candidate data "on a controller-to-controller basis", and spells out the consequence: "For the avoidance of doubt, a subject access request made to one Party in its capacity as data controller shall not oblige the other Party to disclose any personal data it holds independently in its capacity as a data controller." The centre holds your coursework file, your internal assessment records and its own correspondence about you; OCR holds what the centre sent it and what it did with it. If you want both, ask both. A request will not give you a copy of your exam script. OCR's own answer is "No. You are not entitled to receive full copies of original documents held by Cambridge OCR – only your personal information contained in the document." The free route to the script is Access to Scripts, which is not a subject access request: scripts are "free to download", but exams officers download them through Cambridge's My Cambridge sign-on and "you must have written permission from students before you can access the scripts" — so you ask your centre, and there is a download deadline on OCR's key dates page. A request cannot change a grade, and it is the one route you can use on your own. Reviews of marking go through your centre — "You must submit all reviews via Interchange" — and appeals are narrower still: "Candidates and/or their parents/carers cannot appeal directly themselves." A review can also go the wrong way: centres "must obtain the written consent of candidates for clerical checks and reviews of marking since, with these services, candidates' marks and subject grades may be lowered." The appeal clock is hard — 30 calendar days from the review outcome, 14 from a malpractice or assessment decision — and a subject access request does not pause it. Private candidates are the exception, and can ask OCR for scripts, reviews and appeals directly, on proof of identity and payment of the fee for a review or appeal. A lost certificate is a separate, chargeable service, and a request is not it. GOV.UK is explicit: "You cannot get a replacement certificate for an O level, CSE, GCSE or A level - your exam board will send you a 'certified statement of results' instead." OCR charges £64.00 per exam series, with fast-tracking for results from 2000 onwards at an additional £20.00 plus postage, and says "90% of applications are completed in 20 working days". If OCR finds nothing it refunds half the fee. A subject access request is free and will tell you what OCR holds; it will not produce a document an employer or a university will accept. Before paying, check with the centre — schools and colleges must keep certificates for 12 months after they are issued. Which board. OCR holds the records of ten predecessor boards, including UCLES, the University of Oxford Delegacy of Local Examinations, the Oxford and Cambridge Schools Examinations Board, the Midland Examining Group and the Royal Society of Arts. If your exams were with a different board, AQA, Pearson Edexcel and the others hold their own. Check with your school or college if you are not sure. What OCR asks for, and what it does not. You must click a verification link in an email before OCR will look at the request, the answer comes back by email only, and OCR "will send details of your request to you, which you can forward on as necessary" rather than to a third party. A parent, guardian or carer is one of the four requester types the form offers. If you cannot use the form, a written request to the Privacy Team address above is valid — Cambridge publishes it for exercising data protection rights — and our free letter template will produce one. Two deadlines and two regulators, and OCR's own guidance is out of date on the law. OCR's help centre says "We have 30 days to respond from the date we receive all required data for us to carry out a search"; Cambridge's candidate notice puts it as "one month of receiving your request", extendable for complex or multiple requests, and that is the entitlement. The same help centre still describes a request as being made "under the Data Protection Act (1998)", which was replaced in 2018 — the current law is the UK GDPR and the Data Protection Act 2018, explained at what a subject access request is. A complaint about how your request was handled goes to OCR and then the ICO; a complaint about a grade or the exam service goes through OCR's complaints process and then to Ofqual in England, CCEA in Northern Ireland or Qualifications Wales. The ICO does not review grades and Ofqual does not handle data protection.

Made under UK GDPR Article 15, subject to the examination exemptions in Schedule 2, Part 4 of the Data Protection Act 2018

An exam board holds your entries, candidate number, marks, moderation and appeal records, and its correspondence with your school or college about you. A university or college holds all of that plus your student record, admissions file, misconduct and fitness-to-practise files. Requests usually arise from a disputed grade, an appeal, a misconduct allegation, or simply needing a record of results from years ago.

Your exam answers are treated differently in law. Under paragraph 25 of Schedule 2, Part 4 of the Data Protection Act 2018, the right of access does not apply to information recorded by candidates during an exam — so, as the ICO puts it, candidates do not have the right to copies of their answers to the exam questions. What the marker recorded is a different matter: the ICO's guide to the exemptions states that information recorded by the person marking the exam is not exempt, so marks and examiners' comments are within scope even though the script itself is not.

There is a timing rule for marks, and it is narrower than it is often described. It applies only where you ask before the results are announced. In that case the organisation must answer within five months of the request, or within 40 days of the results being announced if that comes sooner. Ask after results day and the ordinary deadline applies in full, as set out below.

• Marks, moderation records and examiners' comments
• Entry records, candidate numbers and the results held against your name
• Appeal, review-of-marking and malpractice records
• The full student record and admissions file, at a university or college
• Emails about you between staff, or between the organisation and your school

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.