How will my information be provided?

When you exercise your rights under the General Data Protection Regulation, the information must be:

• Provided in a concise, transparent, understandable and easily accessible form, using clear and plain language, particularly for any information addressed to a child.
• Provided in writing, or by other means, including, where appropriate, by electronic means.
• Where an individual makes the request electronically (e.g. email), where possible, the information must be given to you electronically, unless you request it in another format.
• When requested by you, the information may be provided orally (word of mouth), provided that your identity is proven.
• Except in the cases where your rights are restricted, a data controller cannot refuse to act on your request to exercise your rights unless the controller can prove that they are not able to identify you from the data (e.g. in cases where all the data is anonymous).
• Where a data controller has reasonable doubts about your identity, the data controller may request the provision of additional information necessary to confirm your identity. This is only applicable in respect of the rights of access, rectification, erasure, restriction of processing, data portability, to object and in relation to automated decision making and profiling.