Your data protection rights

Individuals have a number of rights under data protection legislation.

These rights will not always apply in every situation but will depend on the circumstances surrounding the processing of the personal data.

The right of access

You have a right to request access to the personal data the University holds about you. There is no fee, however we will require proof of identity (such as staff or student ID card, or copy of driving licence or passport) and will normally respond to your request within one month.

To help you, we have a subject access request form. We encourage you to complete the form to help us accurately identify the location(s) of the personal data.

Subject access request form

21 May 2018

Complete the subject access request form to help us accurately identify the location of the personal data.

Word

The right to rectification

If you become aware that information we hold about you is factually incorrect you have a right to ask for this to be corrected.

The right to be informed

You have a right to be made aware of how your personal data will be used. This will be communicated via the University's data protection notices.

The right to erasure

Otherwise known as the ‘right to be forgotten’. This right applies in specific circumstances, such as where consent is being relied upon as the legal basis to process you data, consent is withdrawn, and there is no other legal basis for processing the data nor any compelling reason for its continued processing.

The right to restrict processing

In certain circumstances you can ask for the University to temporarily restrict processing of your personal data whilst such processing is reviewed.

The right to data portability

This right applies in specific circumstances, and allows the subject to request that the data held about them by a data controller is moved to another controller. It only applies:

  • to personal data an individual has provided to a controller
  • where the processing is based on the individual’s consent or for the performance of a contract
  • when processing is carried out by automated means.

The right to object to processing

You can object to processing where:

  • it is for the purpose of direct marketing.

The right is more limited where the processing:

  • is based on legitimate interests or the performance of a task in the public interest
  • is being processed for scientific/historical research and statistics.

Rights in relation to automated decision making and profiling

Individuals have a right not to be subject to a decision made solely by automated means (eg by a computer programme) and to profiling.

Further information about your rights and when they may apply can be found on the Information Commissioner's Office website.

Address to send subject access requests

Assurance Service - Data and Information
Cardiff University
Friary House
Greyfriars Road
Cardiff
CF10 3AE

Contact us

Information requests