Know your rights. An organisation must let you know if it using your personal data. This right is called the right to be informed and is covered in Article 13 of the GDPR.
This guide will show you what the right to be informed means and what to expect from organisations.
What does the organisation have to inform me about?
An organisation must inform you if it is using your personal data. The organisation should provide information on the following:
- Why it is using your data
- What type/types of data it is using
- How long your data will be kept
- Information if it is going to transfer your data to third parties, including their names and the reasons for the transfer
- Any Information it is going to transfer the data overseas
- Your information rights
- Where the data is from
- If it is using the data in profiling (a type of automated processing where your personal data is used to analyse or predict things such as your performance at work, economic situation, health, personal preferences and interests)
- How to contact the organisation, and name of the DPO (Data Protection Officer) if they have one.
- Your right to complain to the ICO
The bullet points should make up an organisation’s ‘privacy information’. They should give you this information at the time it collects your data.
For example, if you’re about to sign up to an online newsletter the organisation must provide you with a link to a privacy notice.
If it obtains your data from another source, it should provide privacy information within one month. It may do so in the form of a privacy notice.
Can an organisation not inform me?
Generally, organisations must give you privacy information, but in extreme circumstances they don’t have to. These include where:
- You already have the privacy information and nothing has changed
- Giving you the privacy information is impossible or would require “disproportionate effort”, or
- Giving you the privacy information would make it impossible to use your data or seriously damage the reasons for its use.
How should I raise my concern about how an organisation has handled my information?
If you have concerns about how an organisation has handled your personal data you can voice your concern in any form, verbally, email in writing or use our free app to chat to an organisation directly about your concerns.
We hope you found this guide on the right to be informedTap useful. Go to the My Data Rights section of our blog for more guides.