Information from the University is released for many reasons and to many people on a daily basis.
Royal Holloway is committed to being open and transparent about how we handle information. This page explains how individuals can request access to information held by the University, exercise their data protection rights, and raise concerns or complaints about the handling of their personal data.
The University handles requests for information and personal data rights in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Freedom of Information Act 2000 and the Environmental Information Regulations 2004. These laws set out how requests must be considered, processed and responded to.
The University has a Data Protection Policy, which explains how we meet our data protection obligations.
Under data protection legislation, you have a number of rights in relation to your personal data.
The right to be informed
When we collect your data, either directly from you or via a third party, we have a responsibility to provide you with information about what we will do with your data, how long we will keep it and who we might share it with. The document we use to provide you with this privacy information may be called a collection notice, a privacy notice or covered in a privacy policy.
You can only exercise this right if we have not provided this information to you already.
The right of access
You have the right to access your personal data which the University holds.
The right to rectification
You have the right to have personal data rectified if it is inaccurate or incomplete. If we have disclosed the data to third parties, they will also be informed of the rectification where possible.
The right to erasure
Also known as ‘the right to be forgotten’, the broad principle underpinning this right is to enable you to request the deletion or removal of personal data where there is no compelling reason for its continued processing. This is not an absolute right and in some cases we will need to keep processing some of your personal data.
The right to restrict processing
You have a right to block or suppress processing of personal data. When restricted, the University will store the personal data but not further process it. In addition to this we shall retain only enough information about you to ensure that the restriction is maintained in the future. This is not an absolute right and in some cases we will need to keep processing some of your personal data.
The right to data portability
In certain circumstances you can request that the personal data you have provided to us be transmitted to another data controller.
The right to object
You can object to us processing any of your personal data which is done on the basis of our legitimate interests, in performing a task in the public interest or if we are processing your data for the purpose of research and statistics. You can also object to any direct marketing you receive from the University.
Rights in relation to automated decision making and profiling
You have rights in relation to significant decisions based solely on automated processing, including profiling, which produce legal effects concerning you or have a similarly significant impact. Where the University makes such decisions, it will do so only where permitted by law and with appropriate safeguards in place. These safeguards may include providing information about the decision, enabling you to make representations, obtain human intervention and contest the decision. Additional restrictions apply where special category data is used.
The right to complain to the University about the handling of your personal data
You have the right to complain to the University if you are concerned about how we have handled your personal data or consider that there has been an infringement of data protection legislation in connection with your personal data. The University will acknowledge data protection complaints within 30 days, take appropriate steps to respond without undue delay, and tell you the outcome of your complaint.
If you wish to make a data protection complaint, please complete this form.
You also have the right to complain to the Information Commissioner's Office (ICO). The ICO will usually expect you to have raised your concern with the University first.
If you wish to exercise the right of access (make a subject access request) please complete this form.
If you wish to exercise any of these rights other than the right of access, please complete this form.
If you have any questions about data protection at Royal Holloway or wish to contact the Data Protection Officer, please email dataprotection@royalholloway.ac.uk
Read our Applicant Privacy Notice.
Read our Enquirer Privacy Notice.
