A data subject has the right to be informed about the collection of their personal data and to be informed of how it is being used by the University. This is a key transparency requirement under the GDPR.
Data subjects must be provided with information including: the purpose(s) for processing their personal data, the retention periods and who it will be shared with. This is called 'privacy information' and must be provided to individuals at the time personal data is collected from them. The information provided must be concise, transparent, intelligible, easily accessible and it must use clear and plain language. Privacy information must be reviewed regularly and where necessary, updated. Any new uses of an individual's personal data must be brought to their attention before processing commences.
If personal data is obtained from other sources, individuals must be provided with privacy information within a reasonable period of obtaining the data and no later than one month.
There are a few circumstances when privacy information does not need to be provided, such as if an individual already has the information or if it would involve a disproportionate effort to provide it to them.