Right to Restrict Processing

Article 18 of the General Data Protection Regulations (GDPR) permits the data subject has the right to obtain (temporary) restriction of the processing of their personal data

“Restriction” means that the University is still permitted to store the data, but it should not be further processed (added to, accessed, deleted etc) until the required period of restriction has ended. A marker is required to be placed on the data to indicate where a restriction is in place

Restriction FAQs

When does it apply?

The right to obtain (temporary) restriction of processing is not ‘absolute’ as it only applies in the following situations:

Where the data subject is contesting the accuracy of the personal data that is being processed
Restriction must be put in place for the period required for the University to verify the accuracy of the personal data.
Restrictions can be lifted if the data is proved to be accurate or once it has been rectified to the satisfaction of the data subject
Where the processing is suspected/proven to be unlawful and the data subject opposes the erasure their personal data and requests for restriction instead.
Where the University no longer needs the data our own purposes, but the data subject requires us to retain it for the establishment, exercise or defence of legal claims (including against the University)
Where the legal condition for processing is identified under ‘legitimate interests’ of the University, and the data subject objects to their own interests being overridden

When doesn't it apply?

The right to obtain (temporary) restriction of processing is does not apply in the following situations:

Where the University has verified the accuracy of the personal data that is being processed and the data is not being processed under ‘legitimate interests’.
Where the University can obtain consent from the data subject to continue.
Where the processing is necessary for the establishment, exercise or defence of legal claims.
Where processing is required for the protection of third parties
Where processing is required for important public interest under EU or state law.

How long does the University have to comply?

Without any undue delay and certainly no longer than a month from the date of request.

Is there a fee?

What if the University doesn’t comply?

If you are not satisfied, you may request the ICO to undertake the judicial review as to whether or not the University has complied with your rights.

How do I request for restriction of data?

Requests can be made to any member of staff or they may be submitted to the University Data Protection Officer:

T: +44 (0)191 243 7357

E: dp.officer@northumbria.ac.uk

P: Vice-Chancellor’s Office, Legal Services Team, Northumbria University, Ground Floor, Pandon Building, Newcastle upon Tyne, NE1 8ST

What will th eUniversity do?

For paper based systems

a note will be placed on the individual file to show that the record has been ‘restricted’ and the file shall be locked securely away until the restriction is lifted.

For automated systems

The restriction of the processing will be clearly indicated in the system(s).
Where the system is a data source, restriction must temporarily prevent data being shared with other processing systems and should mark any data already in those systems as ‘restricted’

If data is disclosed to third parties, the University must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.

Proof of Identity

To make sure that someone doesn’t request us to restrict your data illegally, we will ask for proof of your identity. Acceptable proof of identity shall be any of:

A copy of Photographic ID such as passport, driving licence or Student ID
Birth Certificate.
Two utility bills or bank statements (with redacted transactions) containing a full address of less than 3 month sold.

Please note that originals are not required, but can be scanned and sent in via email or they will be copied if presented in person. The University will refuse a request if we do not have evidence that the requestor is entitled to access the information

GDPR - Rights of the Individual

Northumbria Open Days

Open Days are a great way for you to get a feel of the University, the city of Newcastle upon Tyne and the course(s) you are interested in.

Research at Northumbria

Research is the life blood of a University and at Northumbria University we pride ourselves on research that makes a difference; research that has application and affects people's lives.