Under the Data Protection Act the individual has a number of rights. These are explained under the headings below.
You have the right to get a copy of the information that is held about you. These rights are known as subject access rights. You make the request to the organisation you think is holding, using or sharing the information you want.
The University has established procedures and standard forms to help you make a Subject Access Requests (SARs). See our page on how to access your personal data.
If you believe your personal data is inaccurate, you can write to the organisation to tell them what you believe is wrong with your information and what should be done to correct it.
You can ask an organisation not to process information about you that causes substantial unwarranted damage or distress. The data controller is not always bound to act on the request.
You have the right to request, at any time, that an organisation stops (or does not start) to use your personal data for direct marketing. This must be done in writing. If an organisation receives such a notice it must comply within a reasonable period.
In some circumstances you can object to organisations making significant decisions about you, such as your performance at work or creditworthiness, where the decision is completely automated and there is no human involvement.
You can claim compensation through the courts from an organisation for damage, and in some cases distress, caused by any breach of the Act.
For more information on your rights under the Act please see the Information Commissioner's Office website