Individual rights

The new GDPR (General Data Protection Regulations) puts individuals in control of their data.  It enhances existing rights and introduces new ones.  Here is a brief summary of the rights of individuals under the new regulations.

The Right to be Informed covers some of the key transparency requirements under GDPR.  It is about providing you with clear and concise information about what we do with your personal data.

Right of Access Form

The right of access, more commonly known as subject access, gives you the right to obtain a copy of your personal data as well as other supplementary information.

You have the right to obtain the following:

  • Confirmation that we are processing your personal data;
  • A copy of your personal data; and
  • Other supplementary information 

You are entitled to your own personal data and not to information relating to other people (unless the information is also about you or someone is acting on your behalf)

Right of Rectification Form

You have the right to have inaccurate personal data rectified.  You may also be able to have incomplete data completed, however this will depend on the purposes for the processing. It may involve providing a supplementary statement to the incomplete data.

Right to Erasure Form

You have the right to have your personal data erased.  This is also known as 'the right to be forgotten'.  However this right is not absolute and will only apply in certain circumstances.

You can request that your personal data be erased if:

  • The personal data is no longer necessary for the purpose for which the we collected or processed it for;
  • You withdraw your consent;
  • You object to the processing of your data and we have no over-riding legitimate reason to continue processing it;
  • You object to your personal data being used for direct marketing purposes;
  • We have processed your data unlawfully;
  • We have to comply with a legal obligation;
  • We have processed personal data to offer information society services to a child.

Right to Restriction / Objection

You have the right to restrict or object to the processing of your personal data in certain circumstances.  This means that you can limit the way we use your data and is an alternative to requesting the erasure of your data.

When will my request be completed by?

We are legally obliged to provide you with the information you are entitled to under GDPR within one month of receipt. The time starts the day after the date of receipt. So to be clear: 

  • If a request is received on 5th May then the time limit will start on 6th May. This will give us until 6th June to comply.
  • If this is not possible because the following month is shorter (and there is no corresponding date), then release will be the last day of the following month (example: 
    If a request is received on 30th May the time limit will start on 31st May. There is no corresponding date in June so therefore we will have until 30th June to comply).
  • If the corresponding date falls on a weekend or bank holiday then we will have until the next working day to comply.

The time will start once we receive a complete request (this includes receiving valid ID or any clarification we may have requested).

Need Advice?

Contact gdpr@derby.ac.uk or call 01332 592151.

Alternatively for detailed guidance please visit the ICO's website.

Our Data Protection Officer is James Eaglesfield (01332) 591762
Our Deputy Data Protection Officer is Helen Rishworth (01332) 591954