The University of Gloucestershire is registered with the Information Commissioner’s Office (ICO) as a ‘Data Controller’ under data protection legislation, in that it determines the purposes for which and the manner in which personal data is processed. <\/p>\n\n\n\n
The University collects, holds and processes data about its students, employees, applicants, alumni, stakeholders, contractors and other individuals in order to carry out its business and organisational functions. <\/p>\n\n\n\n
The University’s registration and notification of its processing of personal data is available as part of the Public Register of Data Controllers maintained by the Information Commissioner’s Officer (ICO). The University’s registration number is: Z5286780.<\/p>\n\n\n\n
The University is committed to protecting the rights and freedoms of individuals with respect to the processing of their personal data, and to ensure compliance with appropriate UK and European Union (EU) legislation, including:<\/p>\n\n\n\n
On 25 May 2018, the General Data Protection Regulation (GDPR) came into force, strengthening data protection for individuals within the EU, bringing privacy laws into the 21st century and giving individuals more control over the way their personal data is used. The ICO’s Guide to the General Data Protection Regulation<\/a> provides further information. <\/p>\n\n\n\n The Data Protection Act (DPA) 2018 is UK legislation which introduces agreed modifications (derogations) to the GDPR to make it work for the benefit of the UK. It replaces the former Data Protection Act 1998. More information regarding the DPA 2018 is outlined on the ICO’s website<\/a>.<\/p>\n\n\n\n The GDPR and the Data Protection Act 2018 introduce more stringent requirements for data protection and accountability, and give individuals more control over their personal data.<\/p>\n\n\n\n It is the duty of Data Controllers like the University to comply with the data protection principles. The Data Protection Policy describes how the University will discharge its duties in order to ensure continuing compliance with data protection legislation, the data protection principles, and the rights and freedoms of data subjects.<\/p>\n\n\n\n Data protection policy<\/a><\/p>\n\t\t\t<\/div>\n\t\t<\/div>\n\t<\/div>\n<\/section>\n\n\n\n If you have any queries or concerns regarding the way in which the University is processing your personal data, please contact the Data Protection Officer using the contact details below.\u200b\u200b<\/p>\n\n\n\n Data Protection Officer A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes. It also means that a breach is more than just about losing personal data. The GDPR introduces a duty on all organisations to report certain types of personal data breach to the ICO within 72 hours of becoming aware of the breach, where feasible.<\/p>\n\n\n\n The Data Breach Policy<\/a> sets out the procedure to be followed by the university if a personal data breach takes place.<\/p>\n\n\n\n You can search for all of our privacy notices in the KnowledgeBase<\/a>.<\/p>\n\n\n\n Individuals have a number of rights under Data Protection legislation:<\/p>\n\n\n\n The right to be informed<\/strong> \u2013 Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement which is usually satisfied by the provision of a Privacy Notice. A Privacy Notice should be given whether we receive personal data directly from an individual or indirectly from someone else.<\/p>\n\n\n\n The right of access<\/strong> \u2013 Individuals have a right to access their personal data which is commonly referred to as a Subject Access Request.<\/p>\n\n\n\n The right to rectification<\/strong> \u2013 Individuals have a right to have inaccurate personal data relating to them to be rectified, or completed if it is incomplete.<\/p>\n\n\n\n The right to erasure<\/strong> \u2013 Individuals have a right to have personal data erased which is also known as the right to be forgotten. This right is not absolute and only applies in certain circumstances.<\/p>\n\n\n\n The right to restrict processing<\/strong> \u2013 Individuals have the right to request the restriction or suppression of their personal data. This right is not absolute and only applies in certain circumstances.<\/p>\n\n\n\n The right to data portability<\/strong> \u2013 Individuals have the right to obtain and reuse their personal data for their own purposes across different services. This right allows individuals to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without it affecting usability.<\/p>\n\n\n\n The right to object<\/strong> \u2013 Individuals have the right to object to the processing of their personal data in certain circumstances.<\/p>\n\n\n\n Rights in relation to automated decision making and profiling<\/strong> \u2013 Individuals have the right not to be subject to a decision based solely on automated decision-making using their personal data.<\/p>\n\n\n\n The right to communication<\/strong> \u2013 Individuals have the right to be told about personal data breaches that pose a high risk of harm to them.<\/p>\n\n\n\n Data Protection legislation states that a response to all rights must be sent without undue delay and at the latest within one calendar month. That period may be extended by two further months if a request is complex or we receive a number of requests from the same individual. If the University proposes to extend the time beyond a month, we will explain to the individual, within one calendar month of receiving a request, why the extension is necessary and when it will be dealt with.<\/p>\n\n\n\n The rights above are not absolute. The legislation sets out the circumstances in which they apply. In addition an exemption may be present in the Data Protection Act 2018 which may apply.<\/p>\n\n\n\n To help us facilitate any of the above requests, it would be helpful if you could complete an Individuals Rights Form, providing as much information as possible, and submit this by email to dataprotection@glos.ac.uk<\/a>\u200b, or send it to:<\/p>\n\n\n\n Data Protection In addition, you will need to attached either a hard copy or electronic copy of one form of ID (passport, driving licence, birth certificate or other internationally recognised ID card) for yourself.<\/p>\n\n\n\n You can complete an Individuals Rights Form below. <\/p>\n\n\n\n <\/p>\n\n\n\n Under the Data Protection legislation, individual\u2019s right have been strengthened. You can complete this form to make an application under those rights.<\/p>\n\n\n\n The University is obliged to respond to your request within the statutory one calendar month of receipt.<\/p>\n\n\nData Protection Act 2018<\/h2>\n\n\n\n
Data Protection Policy<\/h2>\n\n\n\n
Data Protection Officer<\/h2>\n\n\n\n
University of Gloucestershire
Registrar’s Directorate
Fullwood House
The Park
Cheltenham, GL50 2RH
Email: dpo@glos.ac.uk<\/a><\/p>\n\n\n\nData Breaches<\/h2>\n\n\n\n
Privacy Notices<\/h2>\n\n\n\n
Individuals Rights<\/h2>\n\n\n\n
Governance and Secretariat Services,
Fullwood House,
The Park
Cheltenham
GL50<\/p>\n\n\n\nIndividuals Rights Form<\/h2>\n\n\n\n