Data Protection

General Data Protection

Privacy Notice

Our Privacy Notice describes what Derby College Group does with the personal information it is provided with. You may be asked to give the College personal information to become a student, client or to use college systems and services.

Privacy Notice (PDF)

If you provide the College with information, it will only be used in the ways described in our Privacy Notice.

The Privacy Notice will be updated on occasion and the latest version is published on the College website. If you have any questions about this policy, please contact the Data Protection Officer.

Subject Access Requests

The General Data Protection Regulation (GDPR) 2016 and College Policy, gives any individual the right to obtain confirmation that their data is being processed, and where this is the case, access to the personal data. The right of access to this information is referred to as Subject Access Request (SAR).

The College will endeavour to provide access to personal data within one month of receipt of a subject access request. If a request is complex, an extension of a further two months will be requested from the individual making the request.

A copy of the information will be provided free of charge however, a ‘reasonable fee’ may be charged is a request is unfounded or excessive.

Who can make a Subject Access Request?

Persons who are entitled to access personal data under this procedure are:

1. The individual (also known as the data subject).
2. A representative of the data subject who has written consent (e.g. solicitor; a court appointed representative if the data subject could no longer manage his or her own affairs; a person with enduring Power of Attorney or quite simply anyone else the individual wants acting for them).
3. The parent or guardian of a child under 16 years of age: In cases where the child agrees, or it was in the child’s best interest for access to the data to be granted.

How can I make a Subject Access Request?

Please complete the form below or download a copy of the Subject Access Request Form (Word Doc) and send it to dpo@derby-college.ac.uk

Please note Derby College will use reasonable means to verify the identity of the individual making the request

Requests to delete personal data

One of the key principles which underpins the GDPR is the right of an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This is also known as the right to be forgotten.

Individuals may have a right to have personal data erased and to prevent processing in specific circumstances such as:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• When the individual withdraws consent.
• When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
• The personal data was unlawfully processed (i.e. otherwise in breach of the GDPR).
• The personal data must be erased to comply with a legal obligation.
• The personal data is processed in relation to the offer of information society services to a child.

How can I make a request to have my personal data deleted?

Please complete the form below. Each request will be dealt with on a case by case basis.

Reference Links

Please note that the right to erasure does not provide an absolute ‘right to be forgotten’. Under GDPR the College can refuse to comply with a request for erasure where the personal data is processed under one of the specific reasons outlined on the ICO website