Data Subject Rights
An individual has the following rights (all of which are qualified in different ways):
- Right to be informed
- Right of access (Subject Access Requests)
- Right to rectification
- Right to be forgotten
- Right to restrict processing
- Right to data portability
- Right to object
- Rights about automated decision making and profiling
Exercising your rights
Any person who wishes to exercise any of those rights detailed above, is required to make their request to +44(0)28 7032 4533 or gdpr@ulster.ac.uk
If a request is received by any member of staff it should be forwarded immediately to gdpr@ulster.ac.uk
The University does not normally charge a fee to process such requests but where the request is manifestly unfounded or excessive, the University may charge a reasonable fee for the administrative costs or refuse to comply (taking into account whether the request is repetitive in nature).
The University must respond to requests without undue delay and at the latest within one month of receipt of a request. This period may be extended by a further 2 months where necessary, taking into account the complexity and number of requests. The Data Subject shall be informed of any such extension within 1 month of the receipt of the request, together with the reasons for the delay.
In the event the University refuses to comply with a request, it will inform the individual without undue delay and within one month of receipt of the request, together with an explanation for not taking action as well as informing the individual of their right to make a complaint to the ICO and of their ability to seek to enforce this right through a judicial remedy.
Where the University has doubts concerning the identity of the individual making the request, the provision of additional information necessary to confirm the identity of the data subject may be requested prior to acting upon a request. The University shall let the Data Subject know without undue delay and within one month if it needs such additional information. The University does not need to act upon the request until it has received such information.
Rights in relation to automated decision making and profiling
The University undertakes to consider an objection without undue delay. In compliance with the law the University will confirm the action it has taken within one month of receipt of an objection.
In the event that the University refuses to comply with an objection, it will similarly inform the individual without undue delay and within one month of receipt of the objection. In such circumstances, the University shall explain its reasons for not taking the action and inform the individual of their right to challenge or appeal such decision and the grounds on which they can appeal.