Individuals’ rights

The General Data Protection Act (GDPR) provides the following rights for individuals:

• The right to be informed

The council must provide you with information regarding the data that we hold about you. Which includes our purpose for processing (using) your information, how long we’ll hold your information for and who we might share this data with. This is called ‘privacy information’. The council’s privacy notices are located on our website.

• The right of access 

We call this right ‘subject access’ and it gives you the right to get confirmation that we are processing your personal data and obtain a copy of it.

• The right to rectification 

You have the right to ensure that inaccurate personal data is rectified or completed if it is incomplete.

• The right to erasure 

GDPR gives individuals the right to have certain information about them erased or deleted. This is also known as the ‘right to be forgotten’. This right is not absolute and therefore only applies in certain circumstances.

• The right to restrict processing 

You have the right to request that the processing of your data is restricted or suppressed, in other words, you can limit how we use your data. This is not an absolute right and therefore it only applies in certain circumstances.

• The right to data portability 

This right allows you to obtain and reuse your personal data for your own purpose across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way without affecting its usability. This right only applies where information is being processed under consent or for the performance of a contract.

• The right to object 

You have a right to object to the processing of your personal data in certain circumstances and this depends on why the council is using (or processing) your information. This right is not absolute and if you want to object you should give specific reasons based on your particular situation.

• Rights in relation to automated decision-making and profiling

This right applies to automated decision-making (where a decision is solely automated and has not had human intervention) and profiling (where automated processing is used to evaluate certain things about an individual). Where organisations use automated decision-making and profiling they must: provide logic involved in the decision-making process; use appropriate mathematical or statistical procedures; ensure that individuals can obtain human intervention, express their point of view and obtain an explanation of the decision and challenge it. Where we are using data in this way, it is outlined in our privacy notices.

How to make a request

More information outlining how the council handles individuals’ rights requests can be found in our Access to Information Policy, which is located in our policy library. We have also produced some frequently asked questions to assist you with this process. 

Requests can be made verbally or in in writing. Where we receive a verbal request the council will transcribe this and request that you confirm in writing that we have understood your request correctly. All requests are offered free of charge and the council must respond within one month of receiving a request. 

When making a request please ensure that you provide us with as much detail as possible about your request. This helps us to ensure that we can process your request quickly and make sure that it is sent to the correct team. 

Make a subject access request

The council must satisfy itself as to the validity of the request

The council takes its data protection obligations seriously and this means that we may need to satisfy the request we’ve received is legitimate. Therefore, we may ask you to provide some identification to help us verify your request. Details of what identification we require can be found in our policy and ‘Accepted forms of identification’ documents (see 'Useful documents').