Your individual rights

At a glance:

• Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the data protection legislation.
• We must provide individuals with information including: the purposes for processing their personal data, our retention periods for that personal data, and who it will be shared with.
• We must provide privacy information to individuals at the time we collect their personal data from them.
• If we obtain personal data from other sources, we must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.

At a glance:

• Individuals have the right to access and receive a copy of their personal data, and other supplementary information.
• This is commonly referred to as a subject access request or ‘SAR’.
• Individuals can make SARs verbally or in writing.
• A third party can also make a SAR on behalf of another person.
• In most circumstances, we cannot charge a fee to deal with a request.
• We should respond without delay and within one month of receipt of the request.
• We may extend the time limit by a further two months if the request is complex or if we receive a number of requests from an individual.
• We should perform a reasonable search for the requested information.
• You should provide the information in an accessible, concise and intelligible format.
• Any information should be disclosed securely.
• We can only refuse to provide the information if an exemption or restriction applies, or if the request is manifestly unfounded or excessive.

At a glance:

• The data protection legislation includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.
• An individual can make a request for rectification verbally or in writing.
• We have one calendar month to respond to a request.
• In certain circumstances we can refuse a request for rectification.

At a glance:

• The data protection legislation introduces a right for individuals to have personal data erased.
• The right to erasure is also known as ‘the right to be forgotten’.
• Individuals can make a request for erasure verbally or in writing.
• We have one month to respond to a request.
• The right is not absolute and only applies in certain circumstances.

At a glance:

• Individuals have the right to request the restriction or suppression of their personal data.
• This is not an absolute right and only applies in certain circumstances.
• When processing is restricted, we are permitted to store the personal data, but not use it.
• An individual can make a request for restriction verbally or in writing.
• We have one calendar month to respond to a request

For further information on your rights you can contact our Data Protection Officer at DPO-DHSC@gov.im or contact the Information Commissioner’s office at ask@inforights.im

Go back to our privacy notice