Data subject rights

The GDPR includes a range of rights for individuals around their data. Anyone whose data is processed by the University can make a rights request under GDPR. Requests are in most cases free, and the University has 30 days to respond. In exceptional cases 30 days can be expanded to 90 and a fee can be charged.

The rights are not absolute, and a number of restrictions apply in certain circumstances. If you receive a request from an individual quoting GDPR rights, please forward as soon as you can to the data protection officer at dataprotectionofficer@essex.ac.uk

We may need to request specific information from the individual to confirm their identity and ensure their right to access the information (or to exercise any of their other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

For more information, please refer to the Data Rights Policy (.pdf).

Rights under GDPR

• Right of access (or “Subject Access Request”, “SAR” or “DSAR”) - An individual has the right to receive a copy of their personal information that we hold about them and information about how we use it. Right to rectification An individual has the right to ask us to correct their personal information where it is incorrect or incomplete.
• Right to erasure (or “right to be forgotten”) -  An individual has the right to ask that their personal information be deleted in certain circumstances, such as where consent has been withdrawn, where it is no longer necessary to keep it of where it legally needs to be deleted. There are a number of restrictions to this right, please contact the Data Protection Officer for further information.
• Right to restrict the use of personal information - An individual has the right to request that we suspend our use of their personal information in certain circumstances.
• Right to data portability - An individual has the right to obtain certain types of their personal data in a structured, commonly used, and machine-readable format and for it to be transferred to another organisation, where this is technically feasible. The right only applies to data provided to us by the individual or obtained in monitoring that individual and where that data is processed under the legal bases of consent and contract.
• Right to object to the use of personal information (including to object to direct marketing, automated decision making and profiling) - An individual has the right to object to the use of their personal information in certain circumstances and subject to certain exemptions.
• Right to withdraw consent - An individual has the right to withdraw their consent at any time where we rely on consent to use their personal information.