This Privacy Notice sets out how we will process personal data for research purposes.
We are committed to undertaking research to the highest standards, and this includes compliance with the relevant data protection legislation: the UK’s General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 (DPA).
Please read this notice alongside our overarching privacy notice.
It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
The University of is the controller (sometimes in common with other data controllers) for the purpose of data protection law, in respect of your personal information collected and used for research.
The type of personal information collected and used will depend on the particular research objectives of the project you are taking part in, and this should be clearly outlined in the Participant Information Leaflet that you should receive before you participate in the project.
The Participant Information Leaflet will also detail if your data may be used for future research, including impact activities following review and approval by an independent Research Ethics Committee, subject to your consent at the outset of this research project.
We use personal data to conduct research as part of the core activities set out in our Charter and Statutes.
We may process your personal data with your consent or (where it concerns special category data) your explicit consent.
We will use your information only for the purposes of research. We will not use your information or contact you for any purpose other than research unless you have agreed to this. You will receive project specific information, in the form of a Participant Information Leaflet and you will be asked to sign Consent Forms, which will set out how and why we will collect and use your personal data.
The lawful basis for the research may depending on the specific details and nature of the research activity. Where appropriate we will seek consent but there are other legal bases available to us in order to pursue research projects.
|Research (where it is not lawfully necessary or appropriate to obtain consent).||Necessary for the performance of a task carried in the public interest i.e. the research.|
|Research (where it is not lawfully necessary or appropriate to obtain consent) and the research includes special category data.||Necessary for the performance of a task carried in the public interest i.e. the research and for archiving purposes, scientific or historical research purposes or statistical purposes in the public interest.|
|Research (where it is not lawfully necessary or appropriate to obtain consent, and where the research is not necessary for the performance of a task carried in the public interest).||Legitimate interests. We need to process your personal data for our legitimate interest of allowing us to manage and carry out research except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.|
We will collect data directly from you when you agree to take part in research.
We may receive data from other universities, or through other partnerships and affiliations with recognised research organisations.
Some of the data we process are provided to us on behalf of third-party data controllers including the Department for Education, Ministry of Justice or other organisations. In some we will only be the processor of those data and in other circumstances the other party may also be a controller of that data.
The Participant Information Leaflet should outline whom your personal data may be shared with. This could include the research project team and collaborators from external organisations who are also working on the research project. We will not disclose the information unless there is a justified reason for the purposes of achieving the research outcomes.
Most personal information used in research will be de-identified before sharing more widely or publishing the research outcomes. If it is not possible to de-identify your information, we may ask for your consent to share or otherwise rely on another legal basis to share your information. If this is the case, this will be clearly specified in the study specific Participant Information Leaflet.
Our researchers will not keep your information for longer than is necessary for the purposes of the research. Personal data will be anonymised or pseudonymised, by removing identifying information and replacing this with an artificial identifier or code, where possible. The duration of time for which we will store your data is dependent on a number of factors, such as the requirements of the research funder or the nature of the research. You will be provided with information about how long your personal information will be kept within the Participant Information Leaflet.
We have retention schedules that set out how long we keep information of all types, including personal data of staff.
If we have to transfer any of your personal data outside the European Economic Area (EEA), we ensure the receiving country or organisation is deemed to have adequate data protection provision. Where a country or organisation does not have adequate protections we will put safeguards in place. Details of these safeguards can be provided to you upon request.
This privacy notice was published on 15 March 2022. We may change this privacy notice from time to time.