Data Protection and Security

Personal data of students, staff and other University members is protected. As such, it should be kept in a secure place, not retained for longer than it is needed and not used for any other purpose other than that agreed to by the data subject.

Personal data must:

• Only be stored or transported on laptops and USB pens on occasions when it is absolutely necessary;
• Be encrypted and/or password protected, and returned to a secure location on campus as soon as possible after it has been used;
• Not be saved on Google Desktop or other computer search or 'cloud' systems and applications.

ICT and the Governance & Planning department both issue policies (see below). A breach of one or more of these policies may result in disciplinary action.

• Data Protection Policy and Guidance [PDF]
• IT Data Security Policy [PDF]

Requests for Personal Information

If you are asked for information about individuals, please remember that unless permission has explicitly been given by the subject of the request:

• The University cannot give out any personal information to anyone over the telephone; it's against the principles of the Data Protection Act and is therefore unlawful;
• Personal information includes but not restricted to confirmation of attendance, results, contact details etc.
• If the police or other crime prevention agency call, visit or email, ask them to send a signed data protection request form to the Data Protection Officer via DPO@beds.ac.uk. The form should be on headed paper (we do not provide standard forms). It should include the signature of a responsible officer, and the correct exemption under the data protection act being relied on in order for us to consider responding to it.

In terms of working practice, colleagues should:

• Keep as little personal information on pcs as possible;
• minimise and encrypt all personal data carried on portable devices, memory sticks etc.;
• Use student numbers and not names when posting student results on noticeboards;
• Take care sending personal information electronically, ideally through accounts which are accessed by passwords.

References for colleagues and students should only be given where you are certain that the individual concerned has given permission for you to do so. You should provide factual information only; for example course details and content, dates of study, marks obtained, punctuality, attendance etc. Confirmations of employment should be referred to the Human Resources Department.

If you are unsure about when it's appropriate or inappropriate to provide personal information, please email: DPO@beds.ac.uk

Data Protection Registration

The University's data protection registration number is Z5608378. For a list of the purposes for which we are registered and therefore allowed to process personal information about, please type Z5608378 into the Information Commissioners Officer's search form for data protection registrations

Training

The Legal Office runs training courses in Data Protection, Freedom of Information and Data Management in Luton and Bedford. For more information on the training provided or if your department would like briefings for team meetings etc. please email Legaloffice@beds.ac.uk

• Training slides Data Protection Act 2018 [PPTX]

FAQs and Useful Links

Data Protection: FAQs [PDF]

The Information Commissioner's Office oversees data protection and freedom of information legislation. The ICO site contains helpful information concerning the rights of individuals in relation to accessing their personal data (through data protection) and information from public bodies (through freedom of information), together with associated information and advice concerning identity fraud and guidance on reducing the amount of junk correspondence you receive.

The Telephone Preference Service is the official central opt out register on which you can record your preference not to receive unsolicited sales or marketing calls. It works. Similar services, also accessible on the same page, are available for mail and fax.

Data Sharing and Processing agreements

Please see the University's data sharing agreement [DOCX] template.

Please see the University's data processing agreement [DOCX]