Skip to main content

Data Subject Requests

On this page you will find information about Data Subject Requests as well as guidelines for their submission. If you wish to make any requests regarding your personal data being held by Northwestern, such as requesting its deletion or opting out of marketing communications, please review the information provided below before submitting.

Please also note that Northwestern is obligated to maintain certain records about individuals, and it may not be possible to fulfill your request.

What is a Data Subject Request?

A Data Subject Request (DSR) is any request originating from a person whose personal information is held by an organization or business, in which the subject seeks to exercise some control or right(s) over the personal information held. Common examples of DSRs include things like data deletion or opting out of marketing communications.

Data subject rights are often included in privacy laws which vary significantly with respect to things like legal scope and which rights are afforded to data subjects. Depending on various factors such as geographic location, your personal data may be subject to certain data privacy laws, and you may be entitled to certain rights provided by those laws.

Please note that fulfillment of a DSR is not always possible due to existing legal and regulatory obligations that may apply to your personal data. When submitting a Data Subject Request, please indicate if you believe that a certain privacy law applies to your request and take special care to provide sufficient relevant information to verify your identity, locate your data in Northwestern’s systems, and to assess the applicability of any relevant privacy laws or regulations. The guidelines for providing this information are detailed below.

Because Northwestern is committed to the responsible and ethical use of personal data, it is not strictly necessary that a DSR be required by law. When feasible, requests not mandated by law will be assessed on a case-by-case basis and, if they do not impose an unreasonable administrative burden, will be fulfilled in good faith.

Requests from Privacy Services

Some privacy-focused services allow users to identify organizations that hold their personal data and send template messages on behalf of their users to request the fulfillment of DSRs. In most cases, these messages lack the specificity necessary to accurately locate the sender’s personal information in our systems, verify the authenticity of the requests, confirm the identity of the sender, or assess any legal or regulatory obligations that may enable or disallow the fulfillment of the requested actions.

When applicable, data subjects submitting these types of third-party requests will be directed to the section below which details the guidelines necessary for the assessment and fulfillment of Data Subject Requests.

Where Applicable– Unsubscribe

If you wish to stop receiving e-mails from Northwestern, we encourage you to utilize any “Unsubscribe” links found in messages you’ve received. These links are usually located in the footer of e-mail communications and serve to efficiently fulfill any unsubscribe requests by directly notifying the Northwestern department or school who sent the e-mail. 

Guidelines for Data Subject Requests

Data Subject Requests should be sent to Privacy@northwestern.edu.

Requests submitted should include as much of the information below as is appropriate to the nature of the request. Any information provided in this manner will be used solely for the purpose of fulfilling your request and will be purged once fulfillment is completed.

1. Specify the nature of your data subject request(s).

You may wish to invoke specific privacy laws and applicable data subject rights that you believe apply to your personal data.

Alternatively, you may also describe, in plain English, what you are requesting. For instance:

  • “Please delete my personal data”
  • “I want to stop receiving marketing materials”

2. Provide any relevant contact information that may assist us in locating your information in our systems.

Examples may include:

  • Full Name as it might appear in Northwestern’s systems
  • E-mail Address
    • You may have provided with a request for information
    • Where you are receiving contact from departments within Northwestern
  • Mailing Address where you are receiving marketing materials
  • Phone Number associated with your NU online profile
  • If you are being contacted by Northwestern, information about the sender (department, publication, or other information)
  • Any other information you think might help locate your information

Please provide only information relevant to your relationship with Northwestern University. For instance, if you signed up to receive emails regarding educational programs at Northwestern and provided only your name and e-mail address, then there is no need to include your Mailing Address or Phone Number in your response to this question because it will not help to locate your data.

When submitting a Data Subject Request, please ensure that the originating email address matches the one on file with Northwestern and is associated with your personal data. Failure to do so may prevent successful identification.

3. Indicate where you currently reside (Country/State)

(This allows us to assess any legal or regulatory requirements specific to your location.)

4. Define the nature of your relationship/affiliation with Northwestern University.

(Please list all that apply)

For example, you may identify yourself as a current, former, or prospective student; a current, former, or prospective employee; an alum; a research participant; a contractor; or you may specify any other applicable relationship/affiliation not listed here.

Please be as specific as possible. Northwestern consists of numerous offices, schools, and units, many managing their own systems and contact lists. The information you provide in this section will allow us to appropriately identify and contact these units pursuant to your data subject request.

For instance:

  • If you identify yourself as a current, former, or prospective student, please also specify which College / School at Northwestern you attend, attended, or to which you applied.
  • If you are receiving unwanted electronic or physical mail from Northwestern entities, please specify which offices or publications are responsible for those communications (screenshots would be especially helpful).

To ensure that all appropriate offices are notified of your request, please disclose all applicable relationship(s)/affiliation(s) you may have with Northwestern.

A Note About Records Retention

Please also note that Northwestern is governed by federal, state, and local laws that may limit our ability to satisfy your request in full.  The University has a Records Retention Policy that governs the required retention and deletion timelines for University records, including those that contain personal data.