GDPR Compliance
Your rights, our responsibilities, and how we protect your data
Diary of a Legal Academic is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains what GDPR means, your rights as a data subject, and how we put these principles into practice.
What is GDPR?
The General Data Protection Regulation (GDPR) is comprehensive data protection legislation that came into force in May 2018. The UK GDPR applies to organisations operating in the UK that process personal data. It sets out individuals’ rights regarding how their data is collected, used, stored, and protected.
GDPR is built on principles of accountability, transparency, and individual rights. It recognises that personal data is a fundamental right and that individuals should have control over information about themselves.
Core GDPR Principles
- Lawfulness, Fairness, Transparency: Data must be processed lawfully, fairly, and transparently
- Purpose Limitation: Data collected for specified, explicit purposes cannot be used for incompatible purposes
- Data Minimisation: Only collect data that is necessary and relevant
- Accuracy: Personal data must be accurate and kept up to date
- Storage Limitation: Data must not be kept longer than necessary
- Integrity and Confidentiality: Data must be secure and protected from unauthorised processing
- Accountability: Organisations must demonstrate compliance and responsibility
Your Data Rights Under GDPR
The UK GDPR gives you specific rights regarding your personal data. These rights empower you to understand, control, and manage how organisations use your information.
Right of Access
You can request a copy of the personal data we hold about you. We must provide this within 30 days of your request, in a clear and accessible format.
Right to Rectification
You can request that we correct inaccurate or incomplete personal data. We must make corrections without undue delay.
Right to Erasure
You can request deletion of your data (the “right to be forgotten”) in certain circumstances, such as when data is no longer necessary for its original purpose.
Right to Restrict Processing
You can request that we limit how we process your data while we verify its accuracy or lawfulness. Data can be stored but not actively used.
Right to Data Portability
You can request your data in a structured, machine-readable format (such as CSV) and have it transferred to another organisation.
Right to Object
You can object to processing of your data for direct marketing, profiling, or our legitimate interests. We must stop processing unless we have compelling reasons.
Right to Withdraw Consent
Where we process data based on your consent (such as newsletter signup), you can withdraw that consent at any time without penalty.
Rights Related to Automated Decisions
You have rights regarding decisions made by automated processes that significantly affect you, including the right to human intervention.
How Diary of a Legal Academic Complies with GDPR
Lawful Basis for Processing
We only process your personal data where we have a lawful basis. We identify the specific lawful basis for each type of processing:
- Consent: For newsletter subscriptions and optional data collection
- Contractual Necessity: To fulfil requests you make to us
- Legal Obligation: To comply with law enforcement requests or legal requirements
- Legitimate Interests: To improve our website and services, protect security, or analyse website performance
Transparency and Accountability
We are committed to transparency. Our Privacy Policy clearly explains:
- What data we collect and why
- How long we keep it
- Who we share it with
- Your rights and how to exercise them
Data Subject Rights Requests
We process all data subject requests (access, rectification, erasure, portability, etc.) within 30 days of receipt. We may extend this to 60 days for complex requests. To submit a request, contact us at nelson@diaryofalegalacademic.co.uk
Data Security
We implement appropriate technical and organisational measures to protect your data from unauthorised access, loss, or damage:
- Encryption of data in transit (HTTPS/SSL)
- Secure storage on protected servers
- Limited access to authorised personnel only
- Regular security assessments
- Data breach response procedures
Data Retention
We retain your data only for as long as necessary. Different types of data have different retention periods:
- Newsletter subscribers: Retained while subscribed, deleted 12 months after unsubscribe
- Contact form enquiries: Retained for 3 years
- Website analytics: Retained for 24 months
Exercising Your GDPR Rights
How to Make a Request
To exercise any of your GDPR rights, please contact us at:
Dr Nelson A. Agbor
Diary of a Legal Academic
Email: nelson@diaryofalegalacademic.co.uk
Subject Line: “[Data Subject Right] – [Your Name]” (e.g., “Data Access Request – Jane Smith”)
What to Include in Your Request
- Your full name
- Your email address
- Which right you wish to exercise (access, rectification, erasure, etc.)
- Any relevant details (e.g., approximate dates you interacted with us)
- Proof of identity (copy of ID if we don’t already know you)
Our Response Process
Upon receipt of a valid request, we will:
- Acknowledge receipt within 5 business days
- Process your request and provide a substantive response within 30 days
- Extend to 60 days for complex requests (with notification)
- Provide information free of charge (unless requests are manifestly unfounded or excessive)
- Advise you of any reasons we cannot fully comply with your request
Data Breaches and Your Protection
In the unlikely event of a data breach affecting your personal data, GDPR requires us to:
- Notify you without undue delay (within 30 days where feasible)
- Explain what has happened and what data is affected
- Describe the likely consequences
- Provide steps you should take to protect yourself
- Provide contact details for further information
- Notify the UK Information Commissioner’s Office (ICO) if the breach poses high risk
Cookies and Tracking Under GDPR
GDPR and the Privacy and Electronic Communications Regulations 2003 (as amended) govern how we use cookies and tracking technologies.
Cookie Consent
We obtain your explicit consent before placing non-essential cookies on your device. Essential cookies (for security, session management, or user preferences) do not require consent. You can withdraw consent and manage cookies through your browser settings at any time.
Complaints and the Information Commissioner’s Office (ICO)
If you believe we have not complied with GDPR or you have concerns about how we process your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).
Information Commissioner’s Office
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
- Phone: 0303 123 1113
- Website: www.ico.org.uk
Before escalating to the ICO, we encourage you to contact us directly to resolve any concerns. We take complaints seriously and aim to respond within 14 days.
Children’s Data Protection
We do not intentionally collect personal data from children under 13. If we discover we have done so, we will delete that data immediately.
For children aged 13-18, we process data only with the consent of those with parental responsibility. If you are a parent or guardian concerned about your child’s data, please contact us immediately.
Third-Party Data Processors
Some of your data may be processed by third-party service providers (such as email marketing platforms or analytics providers). GDPR requires that we have Data Processing Agreements in place with these processors to ensure they meet GDPR standards.
We only work with processors that provide appropriate safeguards and comply with GDPR requirements. We do not sell your data to third parties.
Changes to Our GDPR Practices
We may update our data protection practices to reflect changes in law, technology, or our services. We will notify you of material changes through email (for newsletter subscribers) or prominent notice on the website.
Your Questions Matter
If you have questions about GDPR, our data practices, or wish to exercise your rights, please don’t hesitate to contact us at nelson@diaryofalegalacademic.co.uk. We’re here to help you understand and protect your data rights.
For more information, please review our full Privacy Policy or Terms of Use.
Summary
GDPR empowers you with meaningful control over your personal data. At Diary of a Legal Academic, we view data protection not as a compliance obligation, but as a fundamental commitment to respecting your privacy and dignity. We are transparent about our practices, responsive to your requests, and dedicated to safeguarding your information in accordance with the highest standards.