Data Protection

Requesting information

Staff, students (and other users of Chesterfield College Group) have the right to find out how we use and store your personal data.  This is referred to as the ‘Right of Access’ and commonly known as a ‘data subject access request’.

Who can make a request?

You are entitled to access personal data under this procedure as follows:

• The individual (known as the data subject) requests information outlining the personal data required
• A representative of the data subject with written consent (example solicitor; court appointment representative; a person acting on behalf of the data subject)
• The parent or guardian of a child aged under 16 (with agreement/best interest of the child)

You can make a subject access request verbally or in writing.  If you request verbally, we recommend you follow it up in writing and submit to dataprotection@chesterfield.ac.uk

The Chesterfield College Group will check identity prior to any information being released. This is to protect the data in our care.

Information Required

Please be specific about the information you require to help us process your request.  Chesterfield College Group may hold your personal records in different systems and departments of the organisation.

Examples of data kept by us:-

• Personal details name, address, date of birth
• Registers and Timetables
• Attendance and Course Certification
• Additional Learning Support (ALS) Records
• Personnel Records

Please ensure detailed information about your request is submitted via email  to enable appropriate data searches to take place.  Recipient data will not be transferred to third parties except where a legal obligation exists or as required to perform its duties,

Data requests will be supplied where possible in pdf format and submitted via a secure link.  Your Subject Access Request may be refused if your request is ‘manifestly unfounded or excessive’ and/or it includes information about another individual, except where the other individual has agreed to the disclosure or it is reasonable to provide you with this information without the other individual’s consent.

Individuals have the right to request deletion or removal of your personal data where is not no reason for its continued processing.

When the Right Applies

• the personal data is no longer necessary for the purpose which it has been originally collected or processed;
• where consent was relied on as the lawful basis for holding the data, and the individual wishes to withdraw their consent;
• legitimate interests has been relied on as the basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
• personal data has been processed for direct marketing purposes and the individual objects to that processing;
• personal data has been processed unlawfully (ie in breach of the lawfulness requirement of the 1st principle);
• to comply with a legal obligation; or personal data has been processed to offer information society services to a child.

When the Right Does Not Apply

The right to erasure is not absolute and may be refused where processing is necessary for:

• Compliance with a legal obligation.
• The performance of a task carried out in the public interest or in the exercise of official authority.
• The establishment, exercise, or defence of legal claims.
• Archiving purposes in the public interest, scientific or historical research, or statistical purposes (where erasure would seriously impair the objectives).
• Reasons of public interest in the area of public health.

Where we refuse a request, we will explain the reasons and inform you of your right to complain to the Information Commissioner’s Office (ICO).

How to Make a Request

To request erasure of your personal data, please contact:

Email: dataprotection@chesterfield.ac.uk

When you submit a request, we will:

• Verify your identity; and
• Respond within one month of receipt (this may be extended where requests are complex or numerous, in line with UK GDPR requirements).

Data Protection legislation requires that colleges to retain personal data for no longer than is necessary. The College’s data retention policy outlines how data is disposed of, and applies to the Chesterfield College Group workforce.

The Chesterfield College Group support effective records management by:

• minimising storage requirements and therefore reducing cost;
• reducing risk of data breach or litigation.
• to comply with our legal and regulatory requirements
• ensure information can be found and retrieved quickly and efficiently

Chesterfield College Group are committed to handling your personal data in a way that is fair, transparent, and in accordance with the law. If you are unhappy with how we have handled your data, this process outlines how you can make a complaint, in compliance with the UK General Data Protection Regulation 2018 and the Data (Use and Access) Act 2025, and other data protection legislation.

How to Make a Data Protection Complaint

If you have a complaint about how your data has been handled*, please contact our independent Data Protection Officer (DPO). This allows us to investigate and resolve the issue as quickly as possible.

• Email: dataprotection@chesterfield.ac.uk

When you contact us, please provide as much detail as possible about your data protection complaint. This will help us to understand the issue and investigate it thoroughly.

*Please note:

• This process applies to students, parents/carers, staff and authorised third parties
• Complaints relating to safeguarding or academic matters should be raised via the Compliments and Complaints Procedure feedback@chesterfield.ac.uk

What to Expect From Us

We will acknowledge receipt of your complaint within 30 days and then investigate your data protection complaint and provide you with a response without undue delay.

Throughout the process, we will:

• Keep you informed of our progress.
• Request any additional information we may need from you in a timely and proportionate manner.
• Provide you with a clear and comprehensive outcome of our investigation.

If You Remain Unhappy

If you are not satisfied with the outcome of the College’s data protection complaints process, you can complain to the Information Commissioner’s Office (ICO). A form for submitting a complaint to the ICO can be found here:  Make a complaint about how an organisation has used your personal information | ICO

For more information about the ICO and their complaints process, you can visit their website at ico.org.uk.