Your data protection rights
Individuals have a number of rights under data protection legislation.
These rights will not always apply in every situation but will depend on the circumstances surrounding the processing of the personal data.
The right of access
You have a right to request access to the personal data the University holds about you. We will normally respond to your request within one month.
To help you, we have a subject access request form. We encourage you to complete the form to help us accurately identify the location(s) of the personal data. However, if you are unable to use this form, please provide all the necessary detail in your email:
- Your name, identification and contact details
- Any other name by which you were known to the University
- A description of the information you are seeking. Where possible please include:
- areas of the University (Schools/Departments) likely to hold the information
- the time period covering your request
- specific University documents
If you are making a request on behalf of somebody else, please provide a copy of the authority for you to make this request on their behalf.
The identification we require is as follows:
| Requestor | Identification required |
|---|---|
| Current student | Copy student ID card and date of birth |
| Current staff member using private email account | Copy staff ID card and date of birth |
| Former students, former staff and others | Copy valid passport or driving licence |
| For requests made on behalf of others | |
| Third party UK legal firms acting on behalf of the subject | Form of authority to act on the subject’s behalf in relation to SAR |
The University may need to seek additional information from requesters to identify the subject or to establish the authority to receive information. We may also need to consult with third parties where information contains their personal data as well as the data subjects.
Further information can be found on your right to access your personal information on the Information Commissioner’s website at: Your right of access | ICO
Due to the current coronavirus (COVID-19) pandemic, please submit your request via email.
Subject access request form
Complete the subject access request form to help us accurately identify the location of the personal data.
If this document cannot be read by your assistive software, you can request an accessible version by emailing web@cardiff.ac.uk. Please include the assistive tools you use and the format you require.
The right to rectification
If you become aware that information we hold about you is factually incorrect you have a right to ask for this to be corrected.
The right to be informed
You have a right to be made aware of how your personal data will be used. This will be communicated via the University's data protection notices.
The right to erasure
Otherwise known as the ‘right to be forgotten’. This right applies in specific circumstances, such as where consent is being relied upon as the legal basis to process you data, consent is withdrawn, and there is no other legal basis for processing the data nor any compelling reason for its continued processing.
The right to restrict processing
In certain circumstances you can ask for the University to temporarily restrict processing of your personal data whilst such processing is reviewed.
The right to data portability
This right applies in specific circumstances, and allows the subject to request that the data held about them by a data controller is moved to another controller. It only applies:
- to personal data an individual has provided to a controller
- where the processing is based on the individual’s consent or for the performance of a contract
- when processing is carried out by automated means.
The right to object to processing
You can object to processing where:
- it is for the purpose of direct marketing.
The right is more limited where the processing:
- is based on legitimate interests or the performance of a task in the public interest
- is being processed for scientific/historical research and statistics.
Rights in relation to automated decision making and profiling
Individuals have a right not to be subject to a decision made solely by automated means (eg by a computer programme) and to profiling.
Further information about your rights and when they may apply can be found on the Information Commissioner's Office website.
Address to send requests regarding rights, including subject access requests
Due to the current COVID-19 pandemic, we are unable to accept postal requests. Please submit your request by email.