Data Subject Rights

Data Subject Rights

Individuals have a number of specific rights under data protection law to keep them informed and in control of the processing of their personal data.

What are your rights under Data Protection Law?

You have the following rights, subject to certain exemptions, in relation to your personal data:

RightExplanation
Information The right to be informed about the data processing the University does.
Access The right to receive a copy of and/or access the personal data that the University holds about you.
Portability You have the right to request that the University provides some elements of your personal data in a commonly used machine readable format in order to provide it to other organisations.
Erasure The right to erasure of personal data where there is no legitimate reason for the University to continue to process your personal data.
Rectification The right to request that any inaccurate or incomplete data that is held about you is corrected.
Object to processing You can object to the processing of your personal data by the University in certain circumstances including direct marketing material.
Restriction of processing concerning the data subject

You can request the restriction of processing of personal data in specific situations where:

  1. You contest the accuracy of the personal data
  2. You oppose the erasure of the personal data and request restriction instead
  3. Where the University no longer needs the data but are required by you for the establishment, exercise or defence of legal claims
Withdraw Consent

If you have provided consent for the processing of any of your data, you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn. This can be done by contacting the department who obtained that consent or the University’s Data Protection Office (contact details below). 

The right to complain to the Data Protection Commissioner

You have the right to make a complaint in respect of our compliance with Data

Protection Law to the Office of the Data Protection Commissioner.

In order to exercise any of the above rights please contact us using the contact details set out below.

Information provided to data subjects when these rights are exercised must be transparent, understandable and easily accessible, using clear and plain language. The information should be provided in writing, or other means, including, where appropriate, electronically. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is clear or can be proven.

The six lawful reasons for processing personal data are:

  1. Consent
  2. To carry out a contract
  3. In order for an organisation to meet a legal obligation
  4. Where processing the personal data is necessary to protect the vital interests of a person.
  5. Where processing the personal data is necessary for the performance of a task carried out in the public interest.
  6. In the legitimate interests of a company/organisation (except where those interests contradict or harm the interests or rights and freedoms of the individual).