Data subject rights
Data protection laws set rules on how we protect and use information about living individuals (known as ‘personal data’).It also provides a number of rights to those individuals that we hold information about.
Our Data Protection Policy describes our approach to protecting personal data in line with data protection laws.
If you make a request for access to your personal data; or for rectification, erasure or restriction of processing; if you object to the processing of your personal data, or if you have requests that relate to data portability or automated decision making / profiling) we have 1 month to respond, and in most instances requests will be free of charge. If the compliance period is subject to an extension or the request is subject to a fee we will inform you.
If you would like to access your personal information please complete the Subject Access Request Form below.
You can make requests under data protection law directly to the relevant service area or department or directly to the Corporate Information Governance Unit. It would assist greatly if you could make your request in writing (by letter or email), and respond promptly to any additional questions that we have to enable us to assist you.
To process your request we may also require identification from you. If you are making the request on behalf of another person we may require evidence of your authority and identification from you. If this is the case we will inform you and the compliance period for responding to your request will not start until we have received your identification / supporting documents..
Further information on these rights is available below or from the Information Commissioners Office.
Right to be informed
You have the right to be informed about the collection and use of your personal data. Please see the Privacy Notice page for further information.
Right of access
You have the right to request a copy of personal data held about you. It would assist if you could complete the Subject Access Request Form above with as much detail as possible to enable us to locate the information required. This form also outlines the identification and supporting documents we will need to process your request.
Right to rectification
You have the right to request that inaccurate personal data about you be rectified, corrected or completed if the personal data is incomplete.
Right to erasure
You have the right to request that personal data about you is deleted or destroyed in certain circumstances. This is sometimes called the ‘right to be forgotten’.
Right to restrict processing
You have the right to request that use of personal data about you is restricted, limited or suppressed in certain circumstances. Under this right you can also request your personal data is not deleted or destroyed.
Right to data portability
You have the right to request data portability in respect of your personal data in certain circumstances. This means that you can receive personal data about yourself in a machine readable common format, such as a csv file, and you may also request that this personal data is sent to another organisation.
Right to object
You have the right to object to the processing of personal data about youin certain circumstances. If the objection is agreed we will stop using your personal data for the purpose that you object to.
Rights in relation to automated decision making and profiling
In certain circumstances you have the right not to be subject to a decision that is based solely on automated processing if the decision affects your legal rights or other equally important matters. Where an organisation is allowed to make decisions based solely on automated processing, you have the right to:
- express your views on the decision;
- request an explanation of the decision and possible consequences;
- request human intervention in the decision making process and challenge a decision.
Under this right, you can also object to profiling in certain situations including for direct marketing.