Your rights

The General Data Protection Regulation (GDPR) provides individuals with a number of rights. The rights available to you depend on the lawful basis for processing and therefore do not apply in every case. If you wish to enquire about any of these rights please contact dataprotection@gcu.ac.uk

To be informed

You have the right to be informed about the collection and use of your personal data. This is normally communicated through a privacy notice.

The University has central privacy notices for staff, students; and the University website.  Other relevant privacy notices can be accessed via this page.

If you provided information directly to a University service/via a form or as part of a research study you should have been provided with a separate notice at the point of collection.

You can find additional guidance regarding privacy notices from the Information Commissioner's Office.

Rights of access

You have the right to request confirmation that your data is being processed and access to your personal data. For details on how to make a request please see our Accessing Personal Information page

You can find more guidance from the Information Commissioner's Office.

Right to rectification

You have the right to request rectification of inaccurate personal data.

You can find more guidance from the Information Commissioner's Office.

Right to erasure (‘right to be forgotten’)

You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing. The right to erasure does not provide an absolute ‘right to be forgotten’. It applies in specific circumstances.

You can find more guidance from the Information Commissioner's Office.

Right to restrict processing

You have the right to ‘block’ or suppress processing of your personal data if you believe it is inaccurate, the processing is unlawful and in other limited circumstances.

You can find more guidance from the Information Commissioner's Office.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller.  The right of data portability only applies:

to personal data an individual has provided to a controller;

where the processing is based on the individual’s consent or for the performance of a contract; and

when processing is carried out by automated means.

You can find more guidance from the Information Commissioner's Office.

Right to object

You have the right to object to:

processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority;

direct marketing; and

processing for purposes of scientific/historical research and statistics.

You can find more guidance from the Information Commissioner's Office.

Rights related to automated decision making including profiling

The GDPR has provisions on:

automated individual decision-making (making a decision solely by automated means without any human involvement); and
profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.

You can find more guidance from the Information Commissioner's Office.