Veritau Learn

Data Subject Rights

Data subject rights allow individuals control over their own data. The rights under GDPR are:

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making including profiling

Not all of these rights will apply within a school context. We will look at the rights that schools are most likely to be affected by in more detail:

The right to be informed – your Privacy Notice(s) will fulfil this right. It is therefore important that your Notice(s) include the necessary details specified in the legislation and are made easily accessible to your data subjects.

The right to rectification – Individuals have the right to have inaccurate personal data that you hold corrected. Systems within school, such as electronic databases should have the capability to ensure that incorrect data can be rectified.

The right to erasure – Individuals can ask for their personal data to be erased.

Upon receipt of a request, schools should consult with their DPO where necessary for further expertise and advice. None of these are absolute rights, and there will be cases where the school refuses to comply. This should always be recorded.