Right to Rectification

Article 16 of the General Data Protection Regulations (GDPR) states “The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”

One of the principles of GDPR is for the University to ensure that the data we hold be ‘accurate and, where necessary, kept up to date’, and we must take every reasonable step to ensure that we follow this principle. To this end, we provide users with the capability to directly update some of their information directly and will always ask students to update their personal information at the start of each year.

Despite our best efforts, individuals may find that some of data held about them isn’t correct, and where this is the case, they can ask the university to ‘rectify’ these inaccuracies.

When does it apply?

If personal data is inaccurate, contains expressions of opinion based on inaccurate information, or if it is incomplete, then individuals have the right to have that data rectified, or to have a marker placed on it to show any corrections.

When can the University refuse a request for rectification?

Individuals can only ask for ‘inaccurate’ or ‘incomplete’ information to be rectified - they cannot ask the University to amend information simply because they disagree with it. For example:

If they are disputing an assignment mark, or if they disagree with a comment written about their performance in a report, they cannot use GDPR as a mechanism to get these changed.

They may use the University appeals and complaints procedure for this.
Depending upon the outcome of the appeal, relevant changes can be made or a note can be added to the record.

What will the University do?

If the University has made the information available to third-party, we must make them aware that you have exercised this right and ensure that they also take appropriate actions with the relevant information.

For paper based systems

Information in the file should be corrected or replaced.
A note should be placed on the individual file to show that the record has been ‘rectified’ or disputed and not rectified.

For automated systems

The rectification should in principle be ensured by technical means specific to the systems.
Where the system is a data source, rectification should cascade through all relevant systems in the data flow.

How long does the University have to comply?

Where it is required for us to do so, we must make the rectifications without any undue delay and certainly no longer than a month from the date of your request.

Can timescale be extended?

Yes – if the request is complicated, we can extend for a further two months, but we will let you know if this is the case within the original timescale.

Is there a fee?

What if the University does not comply?

If the University is unable to comply, a “supplementary statement” (a note) may be placed on your record to indicate that you have disputed the accuracy of the information and if appropriate, will explanation why we have not been able to comply with the request to make the change(s).

We will then write to inform you why rectification has cannot be done and how you can request a ‘judicial review’ of our decision from the ICO.

If the ICO does not agree with the University, this may result in us being instructed to make the rectification as originally requested, either in full or in part. We must do this within one month of the ICO notifying us.
If the ICO agrees with the University, the note will remain on the systems but no further action will be taken and no changes will be made to the data.

How do I request rectification?

You may submit a request to have data rectified to any member of staff, in a number of different ways, including via telephone or in person, but please be clear when you tell us:

What data you are asking to have rectified.
What you believe is inaccurate.
What the correct version of the data should be.

If you have any issues or queries, please contact the University Data Protection Officer:

T: +44 (0)191 243 7357
E: dp.officer@northumbria.ac.uk
P: Vice-Chancellor’s Office, Legal Services Team, Northumbria University, Ground Floor, Pandon Building, Newcastle upon Tyne, NE1 8ST