Your Right of Access to Personal Information
Under Article 15 of the GDPR individuals have a right of access to their own personal data held by the University. A request for all such information is called a Subject Access Request.
Under the GDPR the individual is entitled to:
- A description of the data
- The Recipients of the data
- Information about any automated decisions that have been made
- A copy of the data on request
- All the above within one month
For further information about the GDPR and your individual rights please see the Information Commissioner's Office.
If a representative is acting on your behalf, please fill out the below form to give them permission to do so.
Making a Subject Access Request
To make a request for information that relates about you, a subject access request, please use the below form if at all possible.
This form is designed to assist the process of making a subject access request and may help to speed the process up. However, it is not mandatory and all subject access requests made in other written formats will be processed.
The requestor must state specifically what information is required. The Data Subject must provide proof of identity, in the case of a student or staff member they must produce their ID card. The University must provide this information within the specified time limit of one month to a stated address. This information, including copy ID, must be sent to the University Information Compliance Team at the address below.
Contact details
Information Compliance Team
University of Westminster
Third floor
32–38 Wells Street
London W1T 3UW
Subject Access Request Procedures
The process of how the University of Westminster handles Data Protection Subject Access Requests can be found in the Subject Access Requests Procedure:
An overview of the process can be seen in the Subject Access Request process flowchart:
Other Data Subject Rights
Under the General Data Protection Regulation (Effective May 2018), individuals in particular circumstances may have specific rights regarding the processing of their personal data.
These are:
- Rights to information about how your personal data is processed (Article 13)
- Rights to access your personal data – Subject Access Requests (Article 15)
- Rights to rectification and erasure (Articles 16, 17, and 19)
- Rights to restriction of processing (Article 18)
- Rights to data portability (Article 20)
- Rights to object to processing (Articles 21-22)
If you have any questions or enquiries relating to these rights please let us know at [email protected].
Rights to information
When obtaining your personal data, we should provide you with the following information:
- The identity and contact details of the university or representative
- The contact details of the Data Protection Officer
- The purposes of the processing for which the personal data is intended
- The recipients of the personal data, if any.
- Whether the University intends to transfer your personal data to a third country or international organisation.
Data subjects have the right to obtain confirmation from the University as to whether or not your personal data is being processed, for what reason, how long the data is to be kept for, and what safeguards are in place if transferring to a country outside the EU or EEA including international organisations.
Rights to rectification and erasure
Data subjects have the right to correct inaccurate personal data held by the University about them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed.
Once data the University has collected is no longer necessary for the purpose for which it was collected and processed, individuals sometimes have the right to have their data erased.
The University automatically destroys records according to our Records Retention Schedule.
Rights to restriction of processing and objections to processing
Individuals sometimes have the right to restrict the processing of their personal data or object to the processing of that data.
If you wish to withdraw consent for the processing of your personal data or otherwise restrict or object to the processing of your personal data please contact the Information Compliance Team.
The processing of your data will be restricted while the complaint is resolved. Third parties who may be processing your data will be notified.
Rights to data portability
Data subjects have the right to receive the personal data concerning them in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from the University.
If you wish to discuss the portability of your personal data please contact the Information Compliance Team.