UK General Data Protection Regulation (UK GDPR)

UK GDPR: What it means for you

The UK General Data Protection Regulation (UK GDPR) is a law that protects personal data and privacy. It sets out rules for how organisations collect, store, share and use personal information and gives individuals important rights over their data. 

The UK GDPR came into force in 2018 and continues to apply in the UK after Brexit. It requires organisations, including universities, to process personal data responsibly, securely and transparently.

If an organisation collects information about you, it must:

• have a lawful reason for doing so
• be transparent about how your data will be used
• keep it safe.

It also means that if you collect or use personal data as part of your studies or research, you're responsible for following data protection requirements.

Under the UK GDPR, organisations must:

• Keep personal data secure.
• Be clear about what data they collect and why.
• Have a lawful basis for processing personal data.
• Only use data for the purposes for which it was collected.
• Respect individuals' data protection rights.

You also have rights, including:

• The right to access your personal data.
• The right to have inaccurate data corrected.
• The right to request the deletion of personal data in certain circumstances.
• The right to know how and why your data is being used.

Your responsibilities as a student or researcher

If you collect or work with personal data for coursework or research projects (for example, through surveys, questionnaires, interviews or recordings), you must follow the seven GDPR principles.

The seven GDPR principles

1. Lawfulness, Fairness and Transparency

• Personal data must be collected and used lawfully, fairly and openly. Individuals should understand what information is being collected and how it'll be used.

2. Purpose limitation

• Personal data should only be collected for a specific, clear purpose and should not be used for unrelated purposes.

3. Data minimisation

• Collect the minimum data you need, so only collect the personal data that's necessary to answer your research question or complete your project.

4. Accuracy

• Take reasonable steps to ensure personal data is accurate and kept up to date where necessary.

5. Storage limitation

• Keep personal data only for it's intended use and dispose of it securely when it's no longer required.

6. Integrity and confidentiality (Security)

• Protect personal data against unauthorised access, loss or misuse. This may include password protection, encryption and secure storage.

7. Accountability

• You must be able to demonstrate that you've followed data protection requirements and University policies, through appropriate records, procedures and documentation.

Tip: Personal data is any information that can identify a living individual, either directly or indirectly, such as a name, student ID number, email address or interview recording.

What is personal data?

Personal data is any information that can identify a living person, either directly or indirectly. Examples include:

• names
• student or staff ID numbers
• email addresses
• phone numbers
• interview recordings
• survey responses that could identify an individual.

Unsure whether your project involves personal data, or how to collect and process data correctly? Speak to your tutor, supervisor or the University's data protection team before collecting any data.