In regards to data processing and recording, data subjects have the right to:

• Be informed of the specific purpose for which the personal data will be processed, and if the data will be transferred or disclosed to a third party.
• make subject access requests regarding the nature of information held and to whom it has been disclosed.
• prevent processing likely to cause damage or distress.
• prevent processing for purposes of direct marketing.
• be informed about the mechanics of automated decision-taking process that will significantly affect them.
• not have significant decisions that will affect them taken solely by automated process.
• sue for compensation if they suffer damage by any contravention of the GDPR.
• take action to rectify, block, erase, including the right to be forgotten, or destroy inaccurate data.
• request the supervisory authority to assess whether any provision of the GDPR has been contravened.
• have personal data provided to them in a structured, commonly used and machine- readable format, and the right to have that data transmitted to another controller.
• object to any automated profiling that is occurring without consent.

<<organisation name>> also ensures that:

• Data subjects may make data access requests as described in Subject Access Request Procedure; this procedure also describes how <<organisation name>> will ensure that its response to the data access request complies with the requirements of the GDPR.
• Data subjects have the right to complain to <<organisation name>> relating to the processing of their personal data, the handling of a request from a data subject and appeals from a data subject on how complaints have been handled in line with the Complaints Procedure.