Â鶹ÉçÇø

Data Subject Rights and Access to Personal Information

Data Protection Legislation gives individuals certain rights over the use/processing of their personal data and a general right of access to their personal data. This is called making a Subject Access Request.

Please note: We will not respond to any requests from third party SAR platforms (ICO guidance April 2019 refers).

Subject Access Request (SAR): For Personal Information

Please read Edinburgh Napier's before you make your SAR. A request must be in writing, preferably on a and submitted with a copy/photo of the required identification documentation to:

Information Governance team
dataprotection@napier.ac.uk

We mainly work remotely and therefore there can be delays in post reaching us, so whilst we prefer to receive your request by email, you can also send it in writing to the address below. If you do so, please can you email us to advise that you have done so. 

Information Governance Manager
Governance & Compliance Services
Edinburgh
EH11 4BN

Please note that we will not respond to requests from 3rd party online platforms/apps/websites as advised by the ICO Scotland Office.

Subject Access Request (SAR): For CCTV Images

Please read Edinburgh Napier's before you make your SAR. A request must be in writing, preferably on a and submitted with the required documentation to:
 
Head of Campus Services
Room 6.B.24
Sighthill Campus
Edinburgh
EH11 4BN 

Request for the personal data of a deceased individual

We would only deal with requests of this type from the deceased individual's next of kin or their legal representative or Executor. If the request is from the deceased individual's next of kin they must provide proof of ID and proof that they are the next of kin. If the request is from the deceased individual's legal representative or Executor they must put their request in writing on headed paper with proof of their identity and a copy of the HMRC form confirming their status. Requests should be sent to:
 
Information Governance team
dataprotection@napier.ac.uk

As we mainly work remotely, please send your request by email wherever possible. If you post a request to us at the address below, please advise us by email that you have done so.

Information Governance team
Governance & Compliance Services
Sighthill Campus
Edinburgh
EH11 4BN

Request for rectification of personal data

Under Article 16 Of the GDPR, EU Citizens have the right to have inaccurate personal data rectified by Data Controllers (in this case the University). This also includes the right to have incomplete personal data completed where relevant. Students and Staff Members have the ability to update their own personal data by using the portals provided by the University:

• Students can use:
• Staff can use HR Connect, which is found on the Staff Intranet when logged into the University network.

If you are unable to make the updates yourself then please contact dataprotection@napier.ac.uk to request a Data Rectification form.

Request for the erasure of personal data ("Right to be Forgotten")

Under Article 17 of the GDPR EU citizens have the right to request the erasure of their personal data. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances. The Information Commissioner’s (ICO) guidance refers: 

We ask you to complete the form below to enable us to find the relevant information in order to make a decision about erasure.

Students/Graduates/Previous Students:

In relation to processing done by the University, this right does not apply as student personal data is processed under GDPR Article 6(1)(e): “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”, which is the Statutory Instrument 1993 Number 557 (S.76). GDPR Article 17(3)(b) refers.

If the course you studied is regulated there will also requirements under other legislation (e.g. health legislation for student nurses and midwives) for the University to keep certain records relating to students. We are also required to keep records to verify qualifications e.g. for crime and fraud purposes.

Therefore, whilst it is not possible to delete your personal data from the University’s records we can remove you from contact lists e.g. the Alumni database, to stop you receiving communications from the University.

For more information please see the University’s Privacy Notices (appropriate to yourself) – they detail the purposes, legal bases, etc. for processing.

Employees:

The University processes your personal data under GDPR Article 6(1)(b): “processing is necessary for the performance of a contract”, etc. which refers to your employment contract. There is also no automatic right under the legislation to have your personal data deleted where this is the legal basis for processing, as the University is required to keep certain records as evidence of your employment.

Requests for deletion will be considered on a case by case basis, dependent on the circumstances, but ‘core’ information is required to be kept permanently, although there may be other information which can be deleted, if requested.

For more information please see the University’s Privacy Notices (appropriate to yourself) – they detail the purposes, legal bases, etc. for processing.

Communications:

Please note that where you ask us not to contact you we are required to keep a record of this to ensure that we adhere to your wishes and you are not re-added to our databases by another means and contacted again.

Rights for Research Participants

Some of the rights under the UK-GDPR contain built-in exceptions for research. If complying with a rights request would prevent or seriously impair the achievement of the purposes of processing for research, then the University may apply an exemption. However, exemptions are not applied in a 'blanket' fashion, and will be decided dependent on the circumstances. 

For further information see the .