Individuals' rights

Under the UK GDPR, you can make a request about any of the following:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• rights in relation to automated decision making and profiling.

Requests can be made verbally or in writing by you or someone acting on your behalf. 

Please include a description of the request and your relationship with the University. We may need to contact you for additional information should some aspect of your request be unclear.

Your request must be accompanied by sufficient proof of identity otherwise we will contact you to provide proof of identity. If you are a current student or staff member, you can contact us from your University email address to verify your identity. 

Alternatively, the University normally accepts photocopies or scans of the following forms of current identification:

• birth certificate;
• drivers' licence;
• passport;
• university ID card.

Please provide your proof of identity to dataprotection@york.ac.uk using the University’s Drop-Off service. This is a secure file transfer facility.

Other forms of identity may be accepted if none of the above are available to you. Please note, ID checks are in place to protect information about you from unauthorised disclosure. Your proof of identity will only be used for this purpose.

If someone is making a request on your behalf, they must provide evidence of their authority to act on your behalf. 

Requests can be made: 

By email: dataprotection@york.ac.uk

By post: Information Governance Team, Legal Services, University of York, Heslington, York, YO10 5DD.

A response will be provided as soon as possible and within one calendar month of receipt of your individual rights request. 

For example:

• The University received a subject access request on 15 May. The time limit for compliance starts the same day. The deadline for compliance will be 15 June.
• The University received a Subject Access request on 31 January. The time limit for compliance starts the same day. The deadline for compliance will be 28 February. 

If the corresponding date falls on a weekend or a UK public holiday, the deadline will be the next working day. 

The timescale for responding to your request will not begin or will be paused where:

• further information or clarification about a request is needed;
• proof of identity is required.

Please note, in certain circumstances, the University may extend the timeframe for compliance by a further two calendar months where requests are complex or numerous. Where this is done, the University will inform you of the intended extension within one calendar month of receipt of the request and explain why the extension is necessary.

If you have additional questions, please email dataprotection@york.ac.uk.