The General Data Protection Regulation (GDPR) provides various rights for individuals in relation to their personal data.
How do I submit a request based on my rights?
If you wish to submit a request based on your rights, you will need to provide us with the following:
- your contact details
- the right you wish to enact
- a description of your request/outcome you want
- proof of your identity (copy of two of the following - passport, driving licence or birth certificate). This is to help us ensure that you are who you say you are
An information rights e-form and a printable form can be found at Data protection. We cannot insist that you use either of these forms but it does include all the information that will help us deal with your request efficiently. If you choose not to use our information rights forms, please provide your request in writing, including all of the information that the form asks for and send to the address outlined below:
The right to be informed
You have the right to be informed about how we will process your information fairly and our privacy notice explains this in more detail.
The right of access
You can make a request to see the personal data that we hold about you by submitting a Subject Access Request (SAR).
Separate guidance can be requested from us for SARs. Alternatively you can find out more information at Data protection
The right to rectification
If your details change, or you believe we are processing inaccurate information about you, you can ask us to change it. Factual inaccuracies will be amended promptly but there may be instances where we are unable to change a record. An example of this would be where there is a difference of opinion on a comment made during a meeting. In such cases, a note would be placed on the record to make sure your views are recorded.
We must respond to your request within one month. Where the request for rectification is complex, this may be extended to two months. If we are unable to take action in response to your request to rectify your information, we will provide you with an explanation as to why we are unable to comply with your request. If you are dissatisfied with our explanation, you have the right to complain to the Information Commissioner’s Office and to a judicial remedy.
The right to erasure
If you withdraw consent or there is no lawful basis to process your personal data, you can request that any personal data we hold on you is erased. If there is no lawful basis for us to process your personal data, we will take reasonable steps to delete it securely as soon as possible.
The right to restrict processing
You have the right to restrict the processing of your personal data if you are in dispute with us over the accuracy of the personal data, while it is being verified. You can also restrict our use of your personal data if there is no legal basis for the processing. If we no longer require your personal data for the purpose it was held, you can ask us to keep records if they are required to establish, exercise or defend legal claims.
The right to data portability
The right to data portability applies if we are processing, by automated means, personal data that you have provided and the processing is with your consent or for the purposes of us performing a contract with you. Where this is so, you have the right to receive the personal data in a structured, commonly used and machine readable format. This will allow you to re-use your personal data for your own purposes or copy it to another organisation in a safe and secure way.
The right to object
You can object to specific types of data processing, including direct marketing (including profiling) and automated decision making. When we intend to process your personal data for such purposes, you will be given the opportunity to object when we contact you about it.
Further information about information rights under GDPR
More detailed information about GDPR information rights can be found on the website of the Information Commissioner