Individual rights under the General Data Protection Regulation
Updated on 21 May 2020
Guidance on how individual rights might be applied to personal data processed by the University
The University recognises and respects individual rights under the General Data Protection Regulation (GDPR). The notes below set out our understanding of those rights and provide some guidance on how they might be applied to personal data processed by the University.
The right to be informed
We publish information on our activities and a series of privacy notices. You will also find additional privacy notices for specific services or activities on the websites of Schools or Services. Where you engage with the University, for example as a research participant, we will also provide you with information on the personal data we are processing and why.
The right of access to personal data
If you require confirmation that your personal data is being processed, the reasons why and/or access to your personal data please follow the steps outlined in the Subject Access Request Standard Operating Procedure below.
If you are a student at the University, you can access information about yourself and your academic results via eVision
If an external an external agency requests personal data from the University pertaining to its students, staff, or other stakeholders please follow the steps outlined in the Standard Operating Procedure – Requests for personal data from external agencies below. This SOP does not apply to SARs for personal data made by Data Subjects.
The right to rectification
If you feel that data held about you is inaccurate or incomplete, please contact the appropriate School or Service and ask them to update it.
The right to erasure
If you would like to ask the University to erase some of the data it holds about you, please email firstname.lastname@example.org. The University will consider your request appropriately.
Please note that this is a limited right and there will be circumstances where the University is not able to erase data. However, should we be unable to erase your data we will endeavour to explain our reasoning to you as far as we are able.
The right to restrict processing of personal data
In certain circumstances the University may restrict (limit) the processing of your personal information. If you would like to request that processing is restricted or discuss a restriction please email email@example.com
The right to data portability
In certain circumstances personal data you have provided to the University may be returned to you in a machine-readable format so that it can be used elsewhere. If you would like to discuss whether data might be portable or make such a request, please email firstname.lastname@example.org
The right to object
If you wish to object to the processing of your personal please email email@example.com. As with other rights under GDPR, there are limits to the application of this right, but we are happy to discuss your request and explain our decisions.
Rights concerning automated decision making and profiling
Should the University engage in automated decision making or automated profiling it will communicate that activity through privacy notices. If you wish to ask any questions about an activity or challenge decisions made on the basis of automated decision making or profiling, please contact the relevant School or Service in the first instance. You may also contact firstname.lastname@example.org