Right to be informed
As a student, employee, guest, visitor or external partner of the UvA, or as a participant in scientific research, you have the right to know what is happening to your personal data and why.
The basic principle is that the UvA will provide you with information on a data processing operation whenever the UvA collects or receives personal data that relate to you. This may take the form, for example, of explanatory notes to fields on a form. The UvA also provides you with information through its privacy statement.
Right of inspection
As a student, employee, guest, visitor or external partner of the UvA, or as a participant in scientific research, you have the right to inspect personal data relating to you that are processed by or on behalf of the UvA.
The UvA receives the enrolment data of its students through the national enrolment portal Studielink. We store these data in the Student Information System (SIS), which is the source system for all student data. SIS is connected to a number of other systems that receive data from SIS for various purposes. E.g. the Identity management system for access and account provisioning.
Click on the link for an overview of the systems that the UvA uses to process personal data.
In most cases, you can inspect your personal data straight away using the following self-service options:
- You can view your personal data via Studielink.
- You can view your study progress data via SIS, which can be found at www.sis.uva.nl.
How can you amend your data?
Please note: the UvA cannot depart from the data contained in the Personal Records Database.
Which data does the UvA share and why?
In most cases, you can inspect your personal data straight away using the self-service options in SIS, which can be found at www.sis.uva.nl.
Click on the link for an overview of the (main) systems that the UvA uses to process your personal data.
Right to data portability
The right to data portability means that you can submit a request to receive your personal data in a ‘machine-readable format’, or to have it transmitted directly to another institution. This can only be done if processing takes place on the basis of consent or in the context of the performance of an agreement between you and the UvA, and only relates to data that have been provided directly by you to the UvA.
The UvA does not receive the above-mentioned personal data directly from the student, but rather from Studielink. You can retrieve and access these data via Studielink (www.studielink.nl). You can also transmit these data to another educational institution through Studielink.
Right to rectification, to restriction of processing, to erasure and ‘to be forgotten’
Based on a request for inspection, you can ask us to rectify, restrict processing of, erase or 'forget' your personal data.
By rectification of data, we mean amending or adding to your data. You can make such a request if your data are incomplete or not (or no longer) correct. The UvA is keen to ensure the accuracy of your personal data and is therefore happy to rectify your data, whether at your request or on its own initiative.
The right to rectification is designed to rectify obvious errors in the case of readily identifiable inaccuracies, e.g. an error in your date of birth. It cannot be used to trigger a substantive review, e.g. you cannot use the right to rectification to correct exam grades or research results.
It may be that, as a result of a statutory obligation, the UvA cannot amend your personal data or can only amend it under specific conditions. If this is the case, you will be notified of the reasons for this.
Restriction of processing
Under the right to restriction of processing, the processing of your personal data, excluding the storage thereof, is temporarily suspended. You can invoke this right if you are unsure about the correctness of the data relating to you that the UvA processes, for example. In the case of a restriction of processing request, your personal data are not deleted. After all, it must remain possible for the requested restriction to be undone.
If the UvA requires your personal data on account of a compelling interest, the UvA can and will continue to process your personal data for this purpose and the restriction of processing request will be rejected. If this is the case, you will be notified of the reasons for this.
Right to erasure and ‘right to be forgotten’
You also have a right to erasure and a ‘right to be forgotten’. You can ask the UvA to delete your data. You can also ask the UvA to remove any link to your personal data ('to be forgotten').
Requests for erasure of personal data and requests to be forgotten can also be rejected. Reasons for this include a statutory processing obligation, a task carried out in the public interest or archiving.
Right to object
Before your personal data are processed, the various interests will be assessed, meaning your right to privacy will be balanced against the interest in processing the data. This assessment is general and abstract.
If a specific situation applies to you, you can inform the UvA of this situation. This will enable the UvA to reconsider the interest in processing the data based on your new or specific situation.
If a processing activity is based on your consent, it is not possible to object to it. In that case, you may, however, withdraw your consent.
How can you use your rights at the UvA?
Submitting a request
You can use the rights accorded to you by the GDPR by sending an email to email@example.com. Please note: personal data that are processed by persons or organizations with an obligation of confidentiality, such as, for example, the student psychologist or company doctor, can be requested directly from the person or organization concerned.
Whenever the UvA receives a request, it must ensure that the person making the request is actually the person to whom the data relate. To this end, the UvA must determine your identity. When in doubt about the identity, the UvA may asked you to provide for additional identification.
Complaints and the Data Protection Officer
The UvA has a Data Protection Officer (DPO). The DPO is an independent compliance officer who ensures that the UvA processes personal data in accordance with the applicable regulations and gives advice on following the GDPR and other relevant regulations. The DPO is registered with the Dutch Data Protection Authority and is the link between the UvA and the DDPA.
Students and employees who believe that their personal data have not been properly handled may submit a complaint to the DPO: firstname.lastname@example.org.
The DPO acts independently and can consult or obtain advice from the Dutch Data Protection Authority about your complaint.
If you do not agree with the way your complaint has been handled by the DPO, you can submit a complaint directly to the Dutch Data Protection Authority. The Dutch Data Protection Authority handles the complaint or the request and makes a decision about this.
The UvA will handle your request with care. You will get an answer as soon as possible. This period may take up to a month. The processing of complex requests may be extended by up to two months. You will be informed of such an extension within a month of your request.