Rights of Data Subjects

Under the Data Privacy Act and its IRR, data subjects have the following rights:

1. Right to be informed — you have the right to know whether personal information about you will be, is being, or has been processed; the purposes of processing; the personal data to be entered; and the scope and method of processing.
2. Right to access, correct, or update your data — you may request access to your personal information, ask for rectification of inaccuracies, or request updates.
3. Right to object or withdraw consent — when processing is based on consent or legitimate interest, you may withdraw consent or object, subject to legal limits.
4. Right to data portability — where applicable, you may obtain a copy of your personal data in a secure and portable format for transfer to another controller.
5. Right to erasure or blocking — if personal data is incomplete, outdated, unlawfully obtained or processed, no longer necessary, or processing is unauthorized, you may request erasure or blocking, subject to legitimate grounds for retention (e.g. legal obligations or defense of legal claims).
6. Right to damages — you may seek indemnification for damages resulting from inaccurate, incomplete, outdated, unlawfully obtained or unauthorized use of your personal data.
7. Right to lodge a complaint with the NPC if you believe your data privacy rights have been violated.

Requests for access, rectification, objection, portability, erasure or complaints may be submitted in writing to the University’s designated Data Protection Officer (DPO) or Data Privacy Office.