When you make a Data Subject Rights request (e.g. a subject access request)

How

Under the Data Protection Act, you have rights as an individual which you can exercise in relation to the information we hold about you. At any point while we are in possession of or processing your personal information, you, the data subject, have the following rights:

Access	You have the right to request a copy of the information that we hold about you
Rectification	You have a right to correct data that we hold about you that is inaccurate or incomplete
Erasure	In certain circumstances you can ask for the data we hold about you to be erased from our records
Restriction of processing	Where certain conditions apply, you have a right to restrict the processing of your data
Portability	You have the right to have the data we hold about you transferred to another organisation
Objection	You have the right to object to certain types of processing such as direct marketing
Objection to automated processing	You also have the right to be subject to the legal effects of automated processing including profiling
Judicial review	In the event that the Department for Enterprise refuses your request under rights of access, we will provide you with a reason as to why. You then have the right to complain as outlined in Complaints

You can make any of these requests by contacting any member of DfE staff, contractors or our third parties, or contacting our Data Protection Officer directly using the details at the end of this notice. You may wish to speak to the Data Protection Officer about your request in person or over the phone ahead of making your request.

What

In order for us to fulfil your request, you will be asked for the following: your, name, address, telephone number or email address (to contact you about your request), any other information to allow us to identify you or your information.

Shared to

Your personal information for the purposes of a Data Subject Rights request will only be shared if you are requesting one of the above rights be extended to our third parties or contractors that may be processing your personal data on our behalf (i.e. they are our Data Processors). We will contact the data processors to advise them of your request in order for them to fulfil your request also. You will be advised if this is the case.

Retention

Data Subject Rights requests and any disclosure correspondence will be kept for three years following the closure of the request. However, requests where there has been a subsequent appeal (either to the DfE Data Protection Officer or the Isle of Man Information Commissioner) will be kept for 6 years following the closure of the appeal.