print_label | resize_label
Your rights


Where your personal data has been transferred under Our BCRs, you have rights to ensure We do the following:

  • Transparency and easy access:We will provide you with information about how We process your personal data to the extent necessary to ensure that processing is fair, and to a level that satisfies the notice requirements of the EU GDPR. This information will normally be provided through a privacy notice which is provided to you at the time AstraZeneca first collects your personal data, or shortly thereafter.
  • Access:You may ask AstraZeneca for access to the personal data that We hold about you and AstraZeneca will take steps to provide you with access to the Personal Data you have requested. However, We may not be able to provide you with all the information you ask for. Any information which is withheld, will only be withheld based on applicable laws. Details of how to access your information will be made available to you on the applicable AstraZeneca privacy notice which covers the processing of your personal data.
  • Rectification, deletion, and restriction: You may ask AstraZeneca in writing to rectify, amend, delete, or suspend the use of the personal data that AstraZeneca holds about you, where that personal data is inaccurate or used in breach of the BCRs. Except in certain circumstances and subject to the applicable law, AstraZeneca will comply with that request. Details of how to request rectification, amendment, deletion or restriction will be made available to you on the applicable AstraZeneca privacy notice which covers the processing of your personal data.
  • Right of objection: You may object to the collection, retention or use of your Personal Data by AstraZeneca if there are compelling legitimate grounds.
  • Automated processing, including profiling: In the unlikely circumstance that We process information about you on a purely automated basis that has a significant impact on you, We shall give you the opportunity to discuss the output of such processing before making those decisions (save to the extent otherwise permitted under applicable law).

Please note that under our IGA, you have rights to enforce as a third-party beneficiary the commitments made by and between the AstraZeneca Affiliates in the IGA relating to the data protection principles described above, as well as:

  • Commitments to notify other AstraZeneca Affiliates in the event that applicable national laws may interfere with their compliance with the BCRs;
  • Commitments to provide access to and make available a complaints procedure for prompt resolution of complaints and concerns brought by individuals in relation to their data, without prejudice to their ability to bring a complaint before a competent supervisory authority; and
  • Commitments to cooperate with competent supervisory authorities, including in relation to auditing and audit reports, reporting changes to the BCRs and resolution of disputes.


Depending on your circumstances and location, you may be able to enforce your privacy rights using the BCRs through one of the regulators who has approved the BCRs or through an English court or a court in your jurisdiction or court where the relevant AstraZeneca Affiliate you believe breached the BCRs is established.

You are also entitled to obtain a copy of the IGA upon request, in order that you can see the mechanism by which We ensure that We protect your information and give you enforceable rights. We may redact some commercially sensitive information from the copy of the IGA we give to you.

As part of the BCRs, We have also agreed that where you can show you have a case against Us, we shall have the burden of proving that We have complied with the BCRs. Before exercising those rights we request you contact us in the manner described in the “Ask a Question/Raise a Concern” section below so that we can try to address your concerns.