Data Subjects' Rights

The GDPR provides data subjects with these rights.

The right to be informed

The University seeks to collect and use your personal data in a transparent manner. We fulfil this right through the use of privacy notices. Please refer to the original privacy notice used at the point that the University collected your personal data. Furthermore, the Privacy Notices Page contains an index of privacy notices used by the University in respect of various processing activities.

The right of access

Unless relevant exemptions apply, you have the right to be told whether we are processing your personal data and, if so, to be given a copy of it. This is known as the right of subject access. The right exists to support individuals to be aware of, and verify, the lawfulness of the processing by organisations. For further information please see the University’s Subject Access Page.

The right to rectification

If you believe that the personal data we hold about you is inaccurate or incomplete, please contact us and we will investigate. If your personal data is inaccurate, we will rectify it. If your personal data is incomplete, we will complete it. Once we have determined what we are going to do, we will contact you to let you know.

The right to erasure

This right is also referred to as ‘the right to be forgotten’. This right is not absolute and applies in certain circumstances. You can ask us to erase your personal data if:

• You believe we no longer need the personal data for the purpose it was originally collected.
• We are relying upon your consent as our lawful basis to process your personal data.
• We are relying upon ‘legitimate interests’ as our lawful basis. We will make a decision whether there is an overriding legitimate interest to continue processing.
• We are using your personal data for the purposes of direct marketing.
• You believe we are processing your personal data unlawfully, i.e. in non-compliance with the lawfulness requirement of the First Data Protection Principle.
• You are a child.

Once we have determined what we are going to do, we will contact you to let you know.

The right to restrict processing

This right is not absolute and applies in certain circumstances. You can ask us to restrict or suppress the processing of your personal if:

• You believe your personal data is inaccurate or incomplete, and you ask us to restrict our processing of your data in certain ways until we verify the accuracy.
• You believe we are processing your personal data unlawfully, i.e. in non-compliance with the lawfulness requirement of the First Data Protection Principle, and you would like us to restrict the processing of your personal data in certain ways rather than erase it.
• You would like us to retain your personal data for longer than stated in our Retention and Disposal Schedule, i.e. to establish, exercise or defend a legal claim.
• You have already objected to our processing of your personal data using the legitimate interest lawful basis, and you would like us to restrict the processing of your personal data in certain ways until we have verified whether we have an overriding legitimate interest to continue processing.

Once we have determined what we are going to do, we will contact you to let you know.

The right to object

This right is not absolute and applies in certain circumstance. You can exercise your right to object to our processing of your personal data if:

• We are using your personal data for the purposes of direct marketing and you object to the promotional activity – absolute right.
• We are processing your personal data using the ‘public task’ lawful basis.
• We are processing your personal data using the ‘legitimate interests’ lawful basis.

Once we have determined what we are going to do, we will contact you to let you know.

The right to withdraw consent

Where the University uses consent as our lawful basis for the processing of your personal data, you have the right to withdraw your consent at any time. We are likely to use consent to conduct promotional or marketing related activities. In the first instance, please use unsubscribe links in any of our communications or use the contact information we provided within the applicable privacy notice that we used at the point we collected your personal data.  

Reporting complaints or personal data breaches

 If you have a complaint or would like to report a personal data breach please provide as much information as possible about the circumstances to enable us to investigate. A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

How to contact us

 To exercise any of your data subject rights please contact: dataprotection@mmu.ac.uk or write to: The Data Protection Officer, Manchester Metropolitan University, Legal Services, All Saints Building, M15 6BH.