ⓘ How this works

This is the foundational right, and the one most often at issue in regulatory complaints. You do not apply for it — we owe it to you automatically. It is why every University form carries a privacy statement and why this Centre exists. If you have been asked for personal data without being told why, that is a failure on our part and we want to know.

⚠ Limits that may apply

• We may redact information identifying another person who has not consented to disclosure.
• Material subject to legal privilege is withheld.
• Information whose disclosure is restricted by other legislation is withheld.

Where we redact, we tell you that we have done so and on what ground. We do not refuse a whole request because part of it is exempt.

⚠ What this right does not cover

Correction addresses factual inaccuracy — a misspelt name, a wrong date of birth, an out-of-date address. It is not a route to change an academic mark, a disciplinary finding or an assessment outcome. Those are matters of academic or administrative judgement and have their own appeal procedures. If you raise one with us, we will tell you which procedure applies and direct you to it rather than simply refusing.

⚠ Please read before applying — this right is qualified

• Degree and award records cannot be deleted. The University has a continuing duty to verify the qualifications it confers — to employers, professional bodies and other institutions, sometimes decades after graduation. If we destroyed the record, we could not confirm your own degree when you needed us to.
• Records we are required by law to keep — financial, employment and statutory reporting records — cannot be deleted while that requirement runs.
• Records needed to establish, exercise or defend a legal claim are retained until the matter concludes.

We state this openly rather than let you discover it when a request is refused. Where we do refuse, we tell you which exemption applies, what we have done instead, and how to challenge the decision.

⚠ An important distinction

• Direct marketing — absolute. Tell us to stop and we stop. We do not weigh it against anything and we do not ask you to justify it.
• Other grounds — qualified. We must stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed for a legal claim.

Where we rely on the qualified limb, we set out the reasoning to you in writing rather than simply asserting that an override exists.

ⓘ What we do when we restrict

We flag the restriction on our systems so that the data cannot be used inadvertently, and we give notice of the restriction to any third party with whom the data has been shared. Restriction is free of charge.

⚠ Scope, time and cost

• Covers data you provided to us — not records the University generated about you, such as examination marks or assessment notes.
• This is the only right for which a reasonable cost may be charged. We confirm the amount before proceeding.
• Where a request is complex or numerous, the law permits an extension determined in consultation with the Data Commissioner. We would tell you if that applied and why.

ⓘ What withdrawal does and does not do

Withdrawal stops future processing that relied on your consent. It does not make past processing unlawful, and it does not affect processing carried out on a different lawful basis.

In practice: your programme registration rests on contract and on our legal obligations, not on consent. Withdrawing a photography consent therefore does not affect your registration — and we will always tell you plainly which of your data rests on consent and which does not, rather than leaving you to guess.