Skip to main content <iframe src="//www.googletagmanager.com/ns.html?id=GTM-NN6ZCP" height="0" width="0" style="display:none;visibility:hidden"></iframe>.
<ul>
<li>Courses</li>
<li>Research</li>
<li>Collaborate</li>
<li>Departments</li>
<li>About</li>
</ul>
<ul>
<li>
<em>From</em> Legal </li>
</ul> Data Protection Act <p>Provides terms and scope of the Data Protection Act</p>
<ul>
<li>Guide</li>
<li> View more guides in Legal </li>
</ul> On this page <ul>
<li>Data Protection Act</li>
<li>Data covered by the Act</li>
<li>Data processing</li>
<li>Lawful basis for processing personal data</li>
<li>Additional conditions for special category data</li>
<li>Six legal principles of Data Protection</li>
<li>Data Protection Policy</li>
<li>The Scope of this Policy</li>
<li>Definitions</li>
<li>Legal Framework</li>
<li>Data protection notification</li>
</ul> Enquiries <p> dataprotection-queries@lists.bath.ac.uk </p> Data Protection Act <p>These pages outline the General Data Protection Regime that applies in the UK.
The General Data Protection Regulation (GDPR) has been tailored and incorporated into UK legislation by the Data Protection Act 2018.</p>
<p>The Data Protection Act 2018 ("the Act") applies to 'personal data', which is information which relates to individuals.
It gives individuals the right to access their own personal data through subject access requests and contains rules which must be followed when personal data is processed.</p>
<p>The Act works in two ways:</p>
<ul>
<li>it provides individuals with rights, including the right to know what information is held about them and the right to access that information.
</li>
<li>it states that anyone who processes personal information must comply with the principles in the Act.</li>
</ul>
<p>You should assume that any personal data relating to an identifiable living individual, held by the University, in any form, are covered by the Data Protection Act.</p>
<p>If you have access to personal data you must familiarise yourself with, and comply with, the following University resources:</p>
<ul>
<li>Data Protection Policy</li>
<li>Data Protection guidance</li>
<li>Data Security information</li>
</ul>
<p>If you are going to be working remotely or using a mobile device please also see data security off-campus.</p> Data covered by the Act <p>The Data Protection Act covers the processing of all 'Personal Data'.
This is data which constitutes information relating to a living individual, (a 'Data Subject') and from which (either on its own or together with other information held) the individual is identifiable, so data held purely in an anonymised form is not covered.</p>
<p>The Data Protection Act covers data held electronically and in hard copy, regardless of where data is held.
It covers data held on and off campus, and on employees' or students' mobile devices, so long as it is held for University purposes, regardless of the ownership of the device on which it is stored.</p> Data processing <p>'Processing' is widely defined and includes every possible form of action that can be taken in relation to data including:</p>
<ul>
<li>obtaining data</li>
<li>recording data</li>
<li>keeping data</li>
<li>using data in any way</li>
<li>sharing or disclosing data</li>
<li>erasing and/or destroying data.</li>
</ul> Lawful basis for processing personal data <p>The University must have a valid lawful basis in order to process personal data and, in most cases, will also need to be satisfied that it is ‘necessary’ to process personal data to achieve the relevant purpose.</p>
<p>There are only six potential lawful bases for processing personal data:</p>
<ol>
<li>Public task – this applies when the processing is necessary for the University to perform a task in the public interest or as part of its official functions.</li>
<li>Legitimate interests - this applies when the processing is necessary for the legitimate interests of the University or a third party, (unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests).</li>
<li>Contract – this applies when the processing is necessary for a contract the University has with the individual, (any processing of personal data under this category must be targeted and proportionate).</li>
<li>Legal obligation – this applies when the processing is necessary for the University to comply with the law.
This can relate to legal, regulatory and other compliance obligations, as well as matters such as the prevention or detection of crime.</li>
<li>Vital interests – the processing is necessary to protect the vital interest of someone, normally this means to protect their life.
</li>
<li>Consent – the individual has freely given clear, informed consent for the University to process their personal data (this will always be for a specific purpose).</li>
</ol> Additional conditions for special category data <p>Special Category Data (which used to be called 'Sensitive Personal Data') are personal data that is more sensitive and needs more protection.
In order to lawfully process any such special category data, in addition to having a lawful basis for its processing, the University will need an additional condition for processing.</p>
<p>There are ten such potential additional conditions which permit Special Category Data to be processed.
The most relevant in the context of the University are set out below:</p>
<ul>
<li>The individual has given explicit consent to processing for one or more specified purposes.<br>
</li>
<li>Processing is necessary in relation to employment, social security and social protection law;<br>
</li>
<li>Processing is necessary to - - protect the vital interests of a person, where they are physically or legally incapable of giving consent.
</li>
<li>Processing relates to personal data which is already in the public domain.
</li>
<li>Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
</li>
<li>Processing is necessary for preventive or occupational medicine, for example, assessment the working capacity of an employee and providing health or social case.
</li>
</ul>
<p>Further information about the legal basis for processing personal data and the conditions for processing special categories of data can be found on the Information Commissioner’s Office’s website.</p> Six legal principles of Data Protection <p>The Data Protection Act sets out the six legal principles with which the University must comply whenever it processes personal data.
These stipulate that the data must:</p>
<p>
<strong>1 'Be processed fairly, lawfully and transparently'</strong>
In order for us to process data 'fairly', we should:</p>
<ul>
<li>ensure that we have a lawful reason to obtain or process the data</li>
<li>the Data Subject must never be deceived or misled - they must normally have a clear understanding of the reasons for which it is proposed that their data be used</li>
<li>care needs to be taken to ensure that personal data is only ever obtained from a person who is legally authorised to supply it.</li>
</ul>
<p>
<strong>2 'Be processed only for specific, explicit and legitimate purposes and shall not be further processed in any manner incompatible with that purpose or those purposes'</strong>
</p>
<p>The main issues raised by the principle are:</p>
<ul>
<li>all personal data which is processed by the University must be covered by our registration with the Information Commissioner.
Most routine uses of personal data by staff will be covered by our registration.
However, if you are processing any data (for example, maintaining a database or running a research project involving the use of personal data) and think it may involve us handling new personal data for the first time or using personal data for a new purpose, please email the Data Protection team at dataprotection-queries@lists.bath.ac.uk for advice.</li>
<li>personal data held for one purpose should not be used for another</li>
<li>personal data must not be disclosed to any third person (other than those described in the University's registration in certain circumstances), so take great care when you receive a request for data from a third party (see guidance on disclosing data).</li>
</ul>
<p>
<strong>3 ' Be adequate, relevant, and not excessive in relation to the purpose or purposes for which they are held'</strong>
</p>
<p>To ensure compliance:</p>
<ul>
<li>you should not collect any personal data not strictly necessary for the specified purpose.
If you are obtaining or holding any special category data take special care to properly consider its necessity</li>
<li>records should also be unambiguous, accurate and professionally worded.
Abbreviations should be widely agreed.
Opinions should be clearly distinguishable from facts.</li>
</ul>
<p>
<strong>4 'Be accurate and, where necessary, be kept up to date'</strong>
</p>
<p>Personal data must not be inaccurate or misleading to any matter of fact.
This applies to information from a third party.
The source of information should always be included on records.</p>
<p>
<strong>5 'Be kept for no longer than is necessary for the specified purpose'</strong>
</p>
<p>As the University needs to hold and process personal data for a variety of different legitimate reasons, it is not always possible to stipulate how long particular data should be retained.</p>
<p>The university has a set of policies on the retention and disposal of different types of records.
For other types of data, it is often necessary to decide on a case-by-case basis when they should be destroyed.</p>
<p>
<strong>6 'Be processed in a secure manner, taking appropriate security measures with regard to rights of accidental or unauthorised access to personal data, or accidental or unauthorised destruction, lose, use modification or disclosure of personal data'</strong>
</p>
<p>Access to personal data will only be granted to staff insofar as is necessary for legitimate operational purposes.
The personal or private use of personal data held by the university is strictly forbidden.</p>
<p>All staff with access to personal data must be mindful that they play a role in ensuring that it is always kept securely.
They must familiarize themselves with the University's Data Protection Policy and follow our guidance on data security.</p> Data Protection Policy <p>The University is committed to protecting the rights and freedoms of all individuals in relation to the processing of their personal data and provides the Data Protection Policy for everyone to follow.</p>
<ul>
<li>The Scope of this policy</li>
<li>Definitions <ul>
<li>Personal data</li>
<li>Special category data</li>
<li>Confidential data</li>
</ul>
</li>
<li>Legal Framework</li>
<li>Responsibilities of staff and students <ul>
<li>Personal Data in the public domain</li>
</ul>
</li>
<li>Lawful basis for processing personal data</li>
<li>Addition conditions for Special Category Data</li>
<li>Data Protection Act Principles</li>
<li>Data Security <ul>
<li>Keeping personal data secure</li>
</ul>
</li>
<li>Prohibited activities</li>
<li>Right to access information</li>
<li>Research - special considerations</li>
<li>Implications of breaching this policy</li>
<li>Conclusion</li>
</ul> The Scope of this Policy <p>We need to comply with the Data Protection Act (as amended from time to time) in relation to all personal data that is processed by the University.
To ensure this happens, it has developed this policy which sets out the obligations of staff in this respect.</p>
<p>This policy and the Data Protection Act apply to all personal data handled by the University, both that held in paper files and data held electronically.
So long as the processing of the data is carried out for University purposes, it also applies regardless of where data is held, (for example, it covers data held on campus and on mobile devices such as electronic notebooks or laptops) and regardless of who owns the PC/device on which it is stored.</p>
<p>'Processing' data is widely defined and includes every plausible form of action that could be taken in relation to the data such as obtaining, recording and keeping, or using it in any way.
sharing or disclosing it.
erasing and destroying it.</p> Definitions Personal data <p>Data which relates to a living individual who can be identified from that data and other information which is in the possession of, or is likely to come into the possession of, the data controller.
The University is the data controller.</p>
<p>Examples of personal data are the name and address of an individual or a student ID number which when put with other information held by the university could identify a student, staff member or participant in a researcher's survey.
The majority of staff (including all line managers) will, therefore, handle personal data at least occasionally.</p> Special Category Data (previously called Sensitive Personal Data) <p>Some personal data are more sensitive in nature and therefore requires a higher level of protection.
The legislation refers to the processing of certain data as ‘special categories of personal data’.
This means personal data about an individual’s:</p>
<ul>
<li>race or ethnic origin of the data subject</li>
<li>their political opinions</li>
<li>their religious beliefs or philosophical beliefs</li>
<li>whether they are a member of a trade union</li>
<li>their physical or mental health or condition</li>
<li>their sexual life</li>
<li>sexual orientation</li>
<li>biometric data (where this is used for identification purposes)</li>
<li>any commission or alleged commission by them of any offence</li>
<li>any proceedings for any offence committed or alleged to have been committed by them, the disposal of such proceedings or the sentence of any court in such proceedings.</li>
</ul>
<p>Staff working in certain research areas (e.g.
Psychology/Health), or in certain roles (e.g.
Student Disability Advice Service, HR, SREO) will have regular access to special category data, others are likely to do so only rarely if at all.</p> Confidential data <p>Data given in confidence or data agreed to be kept confidential (in other words, a secret between two parties) and that is not in the public domain.</p>
<p>Some confidential data will also be personal data and/or sensitive personal data and therefore come within the terms of this policy.
Staff working in certain functions and in senior management roles will handle confidential data regularly.</p>
<p>The University also handles research data which comprises materials collected or created for the purposes of analysis to generate original research results.
Some research data will contain personal data and/or sensitive personal data and in all such cases, the provisions of this policy apply.
For information on how to deal with other aspects of research data see Research Data Management.</p> Legal Framework <p>The University needs to collect and keep certain types of information about the people with whom it deals.
This includes information relating to its staff, students and other individuals.
It needs to process 'personal data' for a variety of reasons, such as to recruit and pay its staff, to record the academic progress of its students and to comply with statutory obligations (for example, health and safety requirements).</p>
<p>The Data Protection Act applies to all 'personal data' processed by the University and to comply with the law all personal data must be collected and used fairly, stored safely and not disclosed to anyone else unlawfully.</p> Responsibilities of staff and students <p>All staff and students must:</p>
<ol>
<li>Be mindful of the fact that individuals have the right to see their 'personal data' (and this may include for example information received from prospective students or staff written in connection with an application to the University or any comments written about them in emails).
They should not, therefore, record comments or other data about individuals which they would not be comfortable with the individual seeing, either in emails or elsewhere.</li>
<li>Immediately report the matter to their line manager and bring it to the Data Protection team's attention, if they find any lost or discarded data which they believe contains personal data, (for example, may include a memory stick).</li>
<li>Immediately report the matter to their line manager and bring it to the Data Protection team's attention, if they become aware that personal data has been accidentally lost or stolen or inadvertently disclosed (for example, if their laptop is stolen or their phone is lost and it has personal data stored on it),</li>
<li>Hold the contents of any personal data which comes into their possession securely.</li>
<li>Ensure that any personal data they provide to the University (for example, their contact details) is accurate.</li>
<li>Notify the University promptly of any changes to their personal data (for example, change of address or emergency contact details).</li>
<li>Only ever obtain or use personal data relating to third parties for approved work or study-related purposes.</li>
</ol>
<p>Staff and students who process 'personal data' must:</p>
<ol>
<li>Ensure that they only ever process personal data in accordance with requirements of the Data Protection Act and in particular:</li>
<li>ensure that they have a valid lawful basis in order to process the data before commencing the processing.
and</li>
<li>only process ‘special category data’, if the processing meets one of the additional conditions for special category data.
and <ul>
<li> follow the 6 Data Protection principles.
The best way to ensure compliance is through familiarisation with this policy and the guidance we provide.
Key points insofar as compliance is concerned include:</li>
<li>Fair processing - for example, ensure that the individual consents to their data being used and knows what it will be used for, and ensure that it is not subsequently used for something else</li>
<li>Data Security - ensure any personal data which is held is always kept and disposed of securely, (taking into account any cybersecurity considerations).</li>
<li>Non-disclosure - ensure personal data is not disclosed to any unauthorised third party.</li>
</ul>
</li>
<li>Familiarise themselves with the guidance and other information published on our Data Protection site and follow it at all times.</li>
<li>If they are going to be working remotely or using a mobile device to store data (for example, a laptop, tablet or mobile phone), it is vital that they are familiar with our Remote Working &.
Use of Mobile Device Guidance, and comply with it and the University's IT Security Policy as special considerations apply.</li>
<li>Be mindful of the scope of Data Protection regulations.
This includes that fact that 'personal data' is widely defined, (and so will cover for example comments made about an individual in an email to someone else), and the fact that it covers data held on remote devices (such as tablets and on mobile phones) regardless of who owns the actual device and where the device is stored.</li>
<li>Seek advice whenever a new or novel form of processing personal data is contemplated or if any data protection related concerns ever arise.</li>
</ol> Personal data in the public domain <p>We hold certain information about staff and students in the public domain.
Personal data classified as being in the 'public domain' refers to information which will be publicly available worldwide and may be disclosed to third parties without recourse to the data subject.</p>
<p>Our practice is to make the following items of data freely available unless individuals have objected:</p>
<ul>
<li>names of members of Council and Senate</li>
<li>staff workplace email addresses and telephone numbers</li>
<li>student university email addresses</li>
<li>academic staff biographies and curricula vitae where supplied</li>
<li>names and academic qualifications of academic and support staff where appropriate</li>
<li>any additional information relating to data subjects which they have agreed to be placed in the public domain and which may be in automated and/or manual form.</li>
</ul>
<p>Similarly, as part of its regular business activities, the University may process personal information about third parties which is already in the public domain where such processing is carried out in accordance with the Data Protection Act principles set out below and is unlikely to cause any damage or distress to the data subject.</p> Data Protection Act principles <p>Anyone using personal data must comply with the 6 Data Protection Principles contained in the Data Protection Act 2018 as they define how personal data can be legally processed: In summary these state that personal data shall:</p>
<ol>
<li>Be obtained and processed fairly, lawfully and transparently.</li>
<li>Be processed for specified explicit and lawful purposes and shall not be processed in any manner incompatible with these purposes.</li>
<li>Be adequate, relevant and not excessive for those purposes.</li>
<li>Be accurate and kept up to date.</li>
<li>Not be kept for any longer than is necessary.</li>
<li>Be processed in a secure manner.</li>
</ol> Data security <p>Keeping personal data properly secure is key in complying with the Data Protection Act.
All staff are therefore responsible for ensuring that if they keep personal data, it is kept securely and is not disclosed (either orally or in writing or accidentally) to any unauthorised party.</p>
<p>Please see the guidance on Disclosing Data for further information on this point.</p> Keeping personal data secure <p>This includes, as a minimum:</p>
<ol>
<li>Ensuring that any personal data recorded in paper form or hard copy documents are kept in locked filing cabinets or locked drawers or in locked offices.</li>
<li>Ensuring that the same measures are taken in regards to any discs or memory sticks or similar devices on which personal data is held, for example, they must also be kept in a secure and locked location.</li>
<li>Ensure that if any personal data is held on a Mobile Device that it is properly password protected and where appropriate encrypted.</li>
<li>Ensuring special care is taken whenever data is transferred from one place to another to ensure the security of the data is paramount, (for example, to avoid losing memory sticks in transit or to avoid sensitive personal data being transferred to a PC which is not password protected and encrypted).</li>
</ol>
<p>Please see the section on data security and the University's IT Security Policy for further information and rules on security.</p> Prohibited activities <p>The following activities are strictly prohibited:</p>
<ul>
<li>using data obtained for one purpose for another supplemental purpose (for example, using contact details provided for HR-related purposes for marketing purposes)</li>
<li>disclosing personal data to a third person outside the University without the consent of the data subject.</li>
</ul> Right to access information <p>Individuals have the right to access any personal data that relates to them which the University holds.
Any person who wishes to exercise this right should see the Subject Access Rights Page for details on how to do so.</p> Research - special consideration <p>Before commencing any research which will involve obtaining or using personal data, the researcher (whether a student or member of staff) and their academic supervisor or Head of Group must give proper consideration to this policy and the guidance contained on our Data Protection webpages and our Research Data Policy and how these will be properly complied with.</p>
<p>In particular, they will need to consider the type of personal data which may be collected, the applicable lawful basis for the processing, whether any special category data is to be processed and if so what additional condition for special category data will be relied on and what additional safeguards required, how ethical consent is to be recorded, the extent to which such data may legitimately be required for the academic objective, how the data will be securely stored, and the duration for which it will be retained.</p>
<p>Personal data obtained or used for research should be limited to the minimum amount of data which is reasonably required to achieve the desired academic objectives and wherever possible any such personal data should be made anonymous so that the data subjects cannot be identified.</p>
<p>For more information refer to the Research Data Policy.</p> Implications of breaching this policy <p>It is a condition of employment in the case of staff and enrolment in the case of students that staff and students will abide by the policies and rules of the University.
Any breach of this policy will be considered to be a disciplinary offence and may lead to disciplinary action.
A serious breach of the Data Protection Act may also result in the University and/or the individual being held liable in law.</p> Conclusion <p>Compliance with the Data Protection Act is the responsibility of all members of the University.
Any questions about this policy or any queries concerning data protection matters should be raised with the Data Protection team</p> Data protection notification <p>The Information Commissioner maintains a public register of organisations that use personal data.
The University has an entry on this register which specifies the main types of data we hold (for example, personal details, education and training info), the main purposes for which we use the data (for example, HR administration, student and staff support services, education and research, and so on) and those to whom it may be disclosed (for example, funding councils, central government).</p>
<p>The University's Registration Number is Z6290890.
Our registration is renewable annually, although we can make additions or changes to it at any time, (for example, if we start to process a new type of data).</p>
<p>In practice, most routine uses of personal data by staff will be covered by our Registration.
However, if you are processing any data (for example, maintaining a database or running a research project involving the use of personal data) and think it may involve us handling new personal data for the first time or using personal data for a new purpose, please email the Data Protection team for advice, and so that our Registration can be amended if necessary.</p>
<p>The University's current Registration can be viewed via the search facility on the Information Commissioner's website.</p> Data Protection team dataprotection-queries@lists.bath.ac.uk © University of Bath 2020 <ul>
<li>Disclaimer</li>
<li>Freedom of information</li>
<li>Modern slavery statement</li>
<li>Privacy and cookie policy</li>
<li>Staying COVID-19 Secure in 2020</li>
<li>Transparency information</li>
<li>Website accessibility statement</li>
</ul>