The General Data Protection Regulation (GDPR) came into force on 25 May 2018. The legislation governs data protection requirements for any organisation or entity managing personal data across the European Union,
The UK Data Protection Act 2018 (DPA) is the implementation of the EU’s GDPR legislation coding its requirements into UK Law.
Both the DPA and GDPR control how personal data is used. Everyone responsible for using personal data needs to follow strict rules when processing personal data, some of the rules are that personal data should only be processed if it is;
There are stronger protections for sensitive or special category data such as;
Personal data is any data that can identify a living individual, for example a name, email address, national insurance number, date of birth etc. there are stricter controls on how organisations approach data privacy and give data subjects more rights in regard to their data.
We have a number of GDPR resources available, and you can view these by navigating the tabs on the the left-hand menu.
Please note that as part of our compliance with GDPR and DPA, all staff are required to complete an E-Learning module annually.
Please contact your HR adviser if you have not yet completed the module.
In line with GDPR and DPA, we need to register all our activities which require the collection, storage, processing, retrieval and disposal of personal data with the Information Commissioner's Office (ICO) and undertake them in accordance with the provisions of the legislation
The University is registered as a Data Controller with the ICO. Our registration number is: Z5608378
A full copy of our registration document can be viewed on the ICO's website at: ico.org.uk
Please feel free to contact the University Data Protection Officer if you have a specific question about GDPR/DPA via DPO@beds.ac.uk
However, it is important to stress that the DPO is not responsible for GDPR at the University, this is everyone’s responsibility.
We have a working group, which has representatives from across the organisation, to ensure that all areas of the University are compliant with GDPR. As well as our DPO, you can also contact the representative from your department to find out more about what is being put in place as part of our compliance regime.
| Role | Incumbent |
| Project Manager/Chair | Ruth Bourne |
| Senior Legal Officer – Governance and Planning | Ashahul Ali |
| Data Protection Officer | Mojgan Casillas |
| Head of Governance and Complinace | Joanne Durham |
| Chief Information Officer | Minesh Tailor |
| Academic Registrar | Jo Coward |
| Director of Teaching and Learning Excellence | Steve Briggs |
| Director of MARC | Bob Cozens |
| Director of HR | Sue Shutter/Jackie Smith |
| Assistant Director of Finance | John McKiernan |
| Chief Executive Officer, Beds SU | Mark McCormack |
| Head of International Admissions and Compliance | Sarah Bryans |
| Director Student Experience and Head of Student Services | Ruki Heritage |
| Head of Corporate Communications | Ulrika Meegolla |
| Director of Academic Partnerships Operations | Tim Gregory |
| Professor of Diversity in Public Health/Director of IHR | Gurch Randhawa |
| Assistant Director Student Experience and Head of Career & Employability | Michelle Everitt/Matthew Harris |
| Director of Facilities and Estates | Alistair Burg-Broquere/Natalie Gray |
| PVC Research & Innovation | Andrew Church |
| Head of Learning Technology | David Pike |
| Director of Library and Learning Resources | Sarah Arkle |
The Group have a Terms of Reference to detail their responsibilities and objectives - TOR GDPR Working Group