Individual rights under the General Data Protection Regulation

The University recognises and respects individual rights under the General Data Protection Regulation (GDPR). The notes below set out our understanding of those rights and provide some guidance on how they might be applied to personal data processed by the University.

The right to be informed

We publish information on our activities and a series of privacy notices. You will also find additional privacy notices for specific services or activities on the websites of Schools or Services. Where you engage with the University, for example as a research participant, we will also provide you with information on the personal data we are processing and why.

The right of access to personal data

If you require confirmation that your personal data is being processed, the reasons why and/or access to your personal data please follow the steps outlined in the Subject Access Request Standard Operating Procedure below.

• SOP - Requests for Personal Data (SARs]

If you are a student at the University, you can access information about yourself and your academic results via eVision

If an external an external agency requests personal data from the University pertaining to its students, staff, or other stakeholders please follow the steps outlined in the Standard Operating Procedure – Requests for personal data from external agencies below. This SOP does not apply to SARs for personal data made by Data Subjects.

• SOP - Requests for personal data from external agencies

The right to rectification

If you feel that data held about you is inaccurate or incomplete, please contact the appropriate School or Service and ask them to update it. 

The right to erasure

If you would like to ask the University to erase some of the data it holds about you, please email us. The University will consider your request appropriately.

Please note that this is a limited right and there will be circumstances where the University is not able to erase data. However, should we be unable to erase your data we will endeavour to explain our reasoning to you as far as we are able.

The right to restrict processing of personal data

In certain circumstances the University may restrict (limit) the processing of your personal information. If you would like to request that processing is restricted or discuss a restriction please email us.

The right to data portability

In certain circumstances personal data you have provided to the University may be returned to you in a machine-readable format so that it can be used elsewhere. If you would like to discuss whether data might be portable or make such a request, please email us.

The right to object

If you wish to object to the processing of your personal please email us. As with other rights under GDPR, there are limits to the application of this right, but we are happy to discuss your request and explain our decisions.

Rights concerning automated decision making and profiling

Should the University engage in automated decision making or automated profiling it will communicate that activity through privacy notices. If you wish to ask any questions about an activity or challenge decisions made on the basis of automated decision making or profiling, please contact the relevant School or Service in the first instance. You may also email us.