GDPR and your rights

Under UK GDPR you can ask to access the personal data held about you, rectify it if it’s wrong, erase it, restrict or object to processing, port what you provided in a machine-readable format, and withdraw consent where processing relies on it.

Who to ask matters

This is the part that trips people up.

  • Your account data — your profile, sign-in identity, notifications — is ours. Ask us.
  • Research data in a study — your answers, your record — belongs to the study. The researcher running it is the controller; we’re the processor. Ask them.

If you ask us about research data, we pass the request to the researcher without undue delay, assist them in responding, and tell you we’ve done so. If you’re not sure who the controller is, ask and we’ll tell you.

What each right maps to in the product

Access — participants can see their own responses study by study, and their record through the study’s participant form. For a full formal request, contact the controller.

Rectification — much of your account data you can edit yourself on your profile. Record data held by a study is corrected by the study team, or by you where the study’s form lets you edit it.

Erasure — three different actions, depending on scope:

  • One survey submission → ask the team to delete that response.
  • Your personal details in a study, keeping the research data → study teams have a one-action erase that strips the personal data from a record or from survey responses while leaving the research answers intact. This is usually what an erasure request in a study actually needs.
  • Leaving entirely → withdraw from the study and choose stop and ask for my data to be deleted. See Joining a study as a participant.

Withdraw consent — the study’s withdrawal route. Withdrawal is timestamped rather than erased, so the record of what you agreed to and when you withdrew stays accurate.

Portability — researchers export from the platform in CSV or JSON; see Exporting your data. Participants request a copy from the study team.

Your Indacas account — see Deleting your account.

Timescales

We verify your identity, respond within one month (extendable by two for complex requests, and we’ll tell you if that happens), and we don’t charge unless a request is manifestly unfounded or excessive.

For researchers

You’re the controller for your study’s data, which means these requests land with you. What Indacas gives you to answer them: a per-record and per-response erase that removes personal data without destroying the research; question-level flags marking which fields are identifying and which are special category; an audit trail showing who accessed and exported what; and versioned consent showing exactly what each participant agreed to.

Governance documentation covering data flow and residency, access control and audit, retention and deletion is available for your institution’s review — ask us.

Complaints

You can complain to the ICO at any time — ico.org.uk, 0303 123 1113. We’d appreciate the chance to resolve it first.

Related articles