In order to ensure that the College processes personal data fairly and lawfully, we must provide certain minimum information to data subjects, regarding the collection and further processing of their personal data.
We typically do this by way of privacy notices at the time the data are obtained or, as a minimum, within a reasonable time (not exceeding one month) after collecting the information. The information given in a privacy notice has to be in a concise, transparent, intelligible and easily accessible form.
The College has a College-wide Privacy Notice for Students and Prospective Students [PDF] which explains how the College uses the personal data of prospective and registered students.
The College has a College-wide Privacy Notice for Staff and Prospective Staff [PDF] which explains how the College uses the personal data of staff (including workers such as casual workers), prospective staff (i.e. job applicants), visiting academics and researchers, honoraries and secondees.
Other notable privacy notices are:
- The Advancement Privacy Notice which explains how the College processes alumni, friends and supporters' personal data;
- The Library Privacy Notice which explains how the Library processes the personal data of the variety of users of library services;
- The College's Privacy notice for events (Word) which explains how the Colleges processes the personal data of people attending College events (including public lectures, demonstrations, tours and online events such as webinars); and
- The College’s Privacy Notice for Agency and Contractors’ Staff [PDF] which explains how the College processes the personal data of individuals engaged by third parties that contract with the College to provide services to the College.
The Privacy Notice for Research Partners, Co-Applicants and Collaborators [pdf] explains how the College processes personal data as part of research activities during the funding application and throughout the research itself.
If you are proposing to process any personal data, you must check if the proposed processing is expressly covered by any of the existing College privacy notices e.g. the Privacy Notice for Students and Prospective Students in the case of prospective students or students’ personal data. If it is covered, clearly draw the attention of the prospective students or students to the Students and Prospective Students Privacy Notice (e.g. by way of link to the Students and Prospective Students Privacy Notice on the form that will be used to collect the personal data).
If it is not covered, the processing will require a standalone privacy notice. Accordingly, please populate this Privacy Notice Template [Word] or, in the event that you need a privacy notice for newsletters only, please download the Newsletter privacy notice template [Word] (in this case, please be sure to check that what you are proposing to do is not already covered by the Advancement Privacy Notice). Send the first draft to the College’s Data Protection Officer for review and sign off.
If you are proposing to engage in medical/health research, you can use this Medical Research Privacy Notice template [Word] (which is drafted to comply with both the GDPR and HRA requirements).
For other research (i.e. not medical/health research) that involves processing personal data, you can use this Non-medical research privacy notice template [Word].