Data Protection - Rights of Individuals

main content

You have a number of rights under GDPR which are explained below. Please note that the rights you have depend on the lawful basis for processing and therefore do not apply in every case. If you wish to enquire about any of these rights please contact dataprotection@strath.ac.uk

Right to be informed

You have the right to be informed about the collection and use of your personal data. This is normally communicated via a privacy notice.

The University has central privacy notices for staff, students; alumni; and the University of Strathclyde website.  Other relevant privacy notices e.g. HESA can also be accessed via this page. 

If you provided information directly to a University service/via a form or as part of a research study you should have been provided with a separate notice at the point of collection. 

You can find additional guidance regarding privacy notices from the Information Commissioner's Office.  Please see ICO Guidance for further details.

 

Right of access

You have the right to request confirmation that your data is being processed and access to your personal data. For details on how to make a request please see our Right of Access page.

In addition, you can find more guidance from the Information Commissioner's website. See ICO guidance for further details.

Right to rectification

You have the right to request rectification of inaccurate personal data.

Please see ICO guidance for further details.

 

Right to erasure (‘right to be forgotten’)

You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing. The right to erasure does not provide an absolute ‘right to be forgotten’. It applies in specific circumstances.

Please see ICO Guidance for further details.

 

Right to restrict processing

You have the right to ‘block’ or suppress processing of your personal data if you believe it is in inaccurate, the processing is unlawful and in other limited circumstances.

Please see ICO Guidance for further details.

 

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller.  The right of data portability only applies:

  • to personal data you have provided to a controller;
  • where the processing is based on your consent or for the performance of a contract; and
  • when processing is carried out by automated means.

Please see ICO Guidance for further details.

Right to object

You have the right to object to:

  • processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority;
  • direct marketing; and
  • processing for purposes of scientific/historical research and statistics.

Please see ICO Guidance for further details.

 

 

Rights related to automated decision making including profiling

 

The GDPR has provisions on:

 

  • automated individual decision-making (making a decision solely by automated means without any human involvement); and
  • profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

Please see ICO guidance for further details.



For more information on your rights please see the Information Commissioner's Office website