Your data protection rights
Individuals have a number of rights under data protection legislation.
These rights will not always apply in every situation but will depend on the circumstances surrounding the processing of the personal data.
The right of access
You have a right to request access to the personal data the University holds about you. There is no fee, however we will require proof of identity (such as staff or student ID card, or copy of driving licence or passport) and will normally respond to your request within one month.
To help you, we have a subject access request form. We encourage you to complete the form to help us accurately identify the location(s) of the personal data.
The right to rectification
If you become aware that information we hold about you is factually incorrect you have a right to ask for this to be corrected.
The right to be informed
You have a right to be made aware of how your personal data will be used. This will be communicated via the University's data protection notices.
The right to erasure
Otherwise known as the ‘right to be forgotten’. This right applies in specific circumstances, such as where consent is being relied upon as the legal basis to process you data, consent is withdrawn, and there is no other legal basis for processing the data nor any compelling reason for its continued processing.
The right to restrict processing
In certain circumstances you can ask for the University to temporarily restrict processing of your personal data whilst such processing is reviewed.
The right to data portability
This right applies in specific circumstances, and allows the subject to request that the data held about them by a data controller is moved to another controller. It only applies:
- to personal data an individual has provided to a controller
- where the processing is based on the individual’s consent or for the performance of a contract
- when processing is carried out by automated means.
The right to object to processing
You can object to processing where:
- it is for the purpose of direct marketing.
The right is more limited where the processing:
- is based on legitimate interests or the performance of a task in the public interest
- is being processed for scientific/historical research and statistics.
Rights in relation to automated decision making and profiling
Individuals have a right not to be subject to a decision made solely by automated means (eg by a computer programme) and to profiling.
Further information about your rights and when they may apply can be found on the Information Commissioner's Office website.
Address to send subject access requests
Assurance Service - Data and Information
CF10 3AE or via email address below