Privacy Notices
What is a Privacy Notice?
Individuals have a right to be informed about the collection and use of their personal data. A Privacy Notice is a way of communicating this information to individuals.
Privacy Notices also help the University to meet its obligations under Data Protection legislation to process personal data in a fair and transparent manner.
Individuals must be presented with a Privacy Notice detailing what information is held about them and how it will be used.
Drafting a Privacy Notice
The University has Privacy Notices in place detailing its use of student and staff personal data:
Check first whether your planned use of personal data is already included in the overarching staff or student Privacy Notices. Please note that your planned use of the data must affect all or most staff or students for the overarching Privacy Notices to be considered applicable.
If your use is not covered, then you will need to provide a bespoke Privacy Notice to the individuals whose personal data you plan to use.
The DP&FOI Office do not draft, approve, or sign-off Privacy Notices. You will find the resources necessary to draft your notice below.
What to include
The DP&FOI Office have created a Privacy Notice template for University use:
The template ensures that the necessary privacy information is presented to individuals, including:
- The identity and contact details of the Data Controller or Joint Data Controllers and the Data Protection Officer.
- What information is being processed and why, and the legal basis or bases for processing.
- Details of any third parties involved in processing the data.
- Whether information will be transferred to countries outside the European Economic Area (EEA) and what safeguards are in place (e.g. data sharing agreement, transfer risk assessment).
- How long the information will be held before it is securely disposed of.
- Details of applicable data subject rights, including the right to complain to the Information Commissioner’s Office (ICO).
- Whether automated decision making or profiling is taking place, the details of how the decisions are made, their significance, and resultant consequences.
The University's Privacy Notice template is designed to be modified to meet the needs of your project and it's target audience (i.e. the affected data subjects). For example, if you pan to process children's data, use simple, age-appropriate language so they understand exactly what is being done with their data.