Data Protection Policy

1. Introduction

• 1.1 The UK General Data Protection Regulation (referred to as the UK GDPR) and the Data Protection Act 2018 (referred to as the DPA) place specific responsibilities on organisations which process personal data and provide individuals to whom that data relates with certain rights.
• 1.2 The University of Bradford, in order to conduct its business, necessarily handles substantial amounts of personal data, a great deal of which falls into the special categories (for definitions of such terms please refer to section 3 below). The University must therefore ensure that this processing is performed in accordance with the UK GDPR and DPA but in doing so, has to also ensure that its business processes remain workable.
• 1.3 The University takes its duties with respect to personal data very seriously, and is committed to ensuring that it complies with the UK GDPR and DPA.
• 1.4 The University also needs to abide by the data protection principles to maintain the confidence and trust of the individuals and organisations that it collaborates with.
• 1.5 The objectives of this policy are to establish:
• • the University’s commitment to data protection and to its compliance with the UK GDPR and DPA;
  • the role of Data Protection Officer; and
  • general principles and responsibilities in relation to the processing of personal data.

3. Glossary

• 3.1 All specific terms in this Policy are as defined by Article 4 of the UK GDPR or elsewhere in the UK GDPR or DPA. The following summarises those and other definitions:
  • controller: an organisation (or person) which determines the purposes and means of the processing of personal data.
  • data protection legislation: UK GDPR, DPA and supporting instruments, regulations and codes of practice.
  • data subject: an identifiable natural living person.
  • DPA: the Data Protection Act 2018, c. 12, as amended as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019)
  • personal data: any information relating to an identified or identifiable person (‘data subject’).
  • privacy notice: a document fulfilling the requirements of Articles 13 and 14 of the UK GDPR which lay out data subjects’ right to be informed about the processing of their personal data (including the purposes for which personal data is collected and used, how it is used and disclosed, how long it is kept, and the controller’s legal basis for processing).
  • processing: any activity performed on personal data including collecting, recording, organising, structuring , storing, adapting, retrieving, consulting, use, disclosure, combination, erasure and destruction.
  • processor: an organisation (or person) which processes personal to data on behalf of a controller.
  • record of processing activity: a formal record of how personal data is processed covering areas such as processing purposes, data sharing and retention. Full details of what is required are listed in Article 30 of the UK GDPR.
  • special categories of personal data: as defined by Article 9 of the UK GDPR:
    • personal data revealing:
      • racial or ethnic origin;
      • political opinions;
      • religious or philosophical beliefs;
      • trade union membership;
    • the processing of genetic data;
    • biometric data processed for the purpose of uniquely identifying a data subject;
    • data concerning health; and
    • data concerning a person’s sex life or sexual orientation.
  • UK GDPR: the UK General Data Protection Regulation (i.e. EU GDPR (Regulation (EU) 2016/679 (General Data Protection Regulation) as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019).

5. General Principles

Commitment to Data Protection

• 5.1 The University is committed to complying with data protection legislation and good practice including:
  • 5.1.1 Registering as a Controller with the Information Commissioner;
  • 5.1.2 Processing personal data lawfully;
  • 5.1.3 Processing personal data only where there is a demonstrable organisational purpose;
  • 5.1.4 Processing only the amount of personal data required for the relevant organisational purpose;
  • 5.1.5 Processing of personal data shall be restricted to those with a demonstrable need to process it;
  • 5.1.6 Personal data shall be retained no longer than necessary and a schedule of retention periods of different categories of information shall be maintained;
  • 5.1.7 The publication of privacy notices for all processing of personal data;
  • 5.1.8 Maintaining a record of processing activity;
  • 5.1.9 Respecting individuals’ rights in respect of their data;
  • 5.1.10 Keeping personal data secure;
  • 5.1.11 Transferring any information to third parties and/or overseas only where there are formal arrangements to ensure adequate protection;
  • 5.1.12 Adopting a privacy by design and by default approach and undertaking data protection impact assessments; and
  • 5.1.13 Reporting breaches of data protection, as required, to the Information Commissioner.

Data Subjects Rights

• 5.2 The DPO will publish guidance on the website advising how data subjects may exercise their rights in respect of their personal data held by or on behalf of the University
• 5.3 Where it is feasible to do so, individual faculties and professional services should provide data subjects with informal access to the personal data they hold.
• 5.4 A formal centralised Subject Access Request process for a data subject’s general right of access to personal data held by the University shall be managed by the Legal and Governance Department. Requests can be made via data-protection@bradford.ac.uk.
• 5.5 The University shall ensure it is satisfied as to the identity of the data subject when they make such requests and that it received proof of authorisation where requests are made on the behalf of a data subject by a third party.

7. Enforcement of this Policy and Sanctions

• 7.1 Compliance with this policy is the responsibility of all members of staff, associates, students, contractors and other third parties who process personal information on the University’s behalf and in the course of their duties, responsibilities’ and studies.
• 7.2 Anyone found to be acting in breach of this policy or who is negligent in their responsibilities to enforce it may be subject to disciplinary or capability procedures.
• 7.3 In serious cases, breaches of this Policy may be grounds for invocation of the Staff Capability and/or Disciplinary Policy and Procedure, and in the case of students, the Academic Misconduct Regulations, Fitness to Practise and/or Student Disciplinary Regulation and Procedure.
• 7.4 Any questions about the interpretation or operation of this policy should be referred to the Data Protection Officer.

9. Related Policies and Standards

• Information Security Policy and subsidiary policies
• Data Breach Procedure
• Data Protection Impact Assessment Procedure
• Privacy Notices
• Regulation on the appropriate use of University IT services
• Records Retention and Disposal Policy
• Staff Capability Policy and Procedure
• Staff Disciplinary Policy
• Student Disciplinary Regulation and Procedure
• Academic Misconduct Regulations
• Fitness to Practise Procedure