Your Rights as a Data Subject According to GDPR

Once you have verified your identity, you have the

  • Right to information acc. Art. 15 GDPR to determine whether and which of your personal data is processed by TU Graz for which purpose (especially storage, usage and transmission to third parties). In doing so, you have a legal obligation to cooperate. In case of excessive and obviously unfounded requests, we can refuse the disclosure or demand a cost reimbursement. Otherwise, you will receive some information within 1 month (justified extension of the term is possible).
  • Right to rectification / completion acc. Art. 16 GDPR if any personal information is incorrect or incomplete.
  • Right to object in accordance with Art. 21 GDPR against legitimate interests asserted by Graz University of Technology, with which you can assert legitimate reasons arising from your particular situation.
    For the period of the assessment, you can also claim your right to restriction of processing (see below). We will only store your data during the time of the assessment, but will not process it otherwise.
  • Right to erasure acc. Art. 17 GDPR if personal data concerning that you are wrongly processed by Graz University of Technology, because:
    • the data are no longer necessary for the purposes for which they were collected or processed,
    • you revoke your consent on which the processing was based and because of the lack of any other legal basis for processing of data,
    • you object, acc. Art. 21 (1) GDPR with reasons worthy of consideration, to the processing of data and there are no legitimate reasons for the processing, or you according to Art. 21 (2) GDPR oppose to the processing for direct marketing purposes,
    • the personal data have been otherwise processed unlawfully.
    For the period of the assessment you have a right to restrict processing. In this case, we may not process the data until you clarify your request for erasure.
  • Right to restrict processing acc. Art. 18 GDPR
    • for the duration of the assessment, the disputed accuracy of the data,
    • for the duration of the assessment of overriding legitimate interest in the case of an opposition,
    • in the case of unlawful processing, if you do not wish to delete the data,
    • if you still need the data in order to assert / exercise or defend legal claims.
  • Right to data portability acc. Art. 20 DSGVO with regard to the data that you have provided to Graz University of Technology or the data that are processed by Graz University of Technology on the basis of your consent or to fulfill a contract concluded with you.
    Rights and freedoms of third parties must not be affected.
  • Right to revoke a given consent acc. Art. 7 DSGVO Consents granted by you are revocable at any time in the future. If we can not rely on any other legal basis, we will no longer carry out the processing affected by the revocation of consent.
    Processing carried out until the revocation remains legal.
Unless otherwise stated, please refer to for these rights.

In addition, you also have the right to appeal to the Data Protection Authority.

Proof of Your Identity

You have 3 options to show us your identity, so that you are able to exercise your rights (as mentioned above):

  1. If you have activated the ID Austria and are therefore registered at TU Graz, you can continue here.
  2. You can send us a signed application letter.
  3. You can contact the IT support personally (with an official photo ID).
In cases 1 and 2 the information will be given to you by unencrypted email, in the latter case only by your explicit consent.