Data Subject Rights Requests Privacy Notice
Your Personal Data
The University of Glasgow will be what’s known as the ‘Data Controller’ of your personal data processed in relation to the exercise of your rights under Data Protection law. This privacy notice will explain how the University of Glasgow will process your personal data.
Why we need it
We are collecting your basic personal data such as your name, contact details (email address), date of birth, staff/student ID number, a copy of photographic ID and, where relevant, limited special categories data (such as about your disability to facilitate an accessible response) to verify your identity and process your rights request. We will only collect the information we need to take your request forward. Thereafter, we may process further personal and special category data that the University holds about you whilst administering your rights request.
Legal basis for processing your data
We must have a legal basis for processing all personal data. In this instance, the legal bases are:
Legal obligation for any personal data you provide as the University has a legal obligation to respond to data subject rights requests.
For any special category data you provide for accessibility reasons, the legal basis is that is necessary for reasons of substantial public interest to meet legislative requirements placed upon the University.
For all other special category data you may volunteer as part of your request, we will take this as an active demonstration of you providing your explicit consent for the University to process this data.
What we do with it and who we share it with
All the personal data you submit is processed by staff at the University of Glasgow in the United Kingdom.
The University’s Data Protection & Freedom of Information (DP&FOI) Office may be required to contact other Offices of the University and individual members of staff, where relevant, to facilitate your request.
For information on how the University processes Right of Access requests, please visit the DP&FOI Office’s website.
How long do we keep it for
Your rights request and all associated information will be retained for 4 years. After this time, your request and associated information will be securely destroyed.
Please note, any appeals, complaints, or investigations relating to data subject rights requests will be retained for 7 years.
What are your rights?*
You can request access to the information we process about you at any time. If at any point you believe that the information we process relating to you is incorrect, you can request to see this information and may in some instances request to have it restricted, corrected or erased. You may also have the right to object to the processing of data and the right to data portability. Where we have relied upon your consent to process your data, you also have the right to withdraw your consent at any time.
If you wish to exercise any of these rights, please contact the DP&FOI Office.
*Please note that the ability to exercise these rights will vary and depend on the legal basis on which the processing is being carried out.
Complaints
If you wish to raise a complaint on how we have handled your personal data, please contact the DP&FOI Office in the first instance.
If you are not satisfied with the complaint outcome, or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).