Data Protection

Full details can be found in the University's Data Protection Policy 

Processing personal data

The Data Protection Principles will remain largely the same and the University will still need to ensure personal data is;

• obtained fairly & lawfully
• processed for specified & lawful purposes
• adequate, relevant and not excessive
• kept accurate and up to date
• kept no longer than necessary
• processed in accordance with the data subject’s rights
• kept safe & secure
• not transferred outside the EEA.

In addition to this, the GDPR will encourage a more proactive and documented approach to compliance. This means the University will have to keep records of the personal data it holds and how that data is processed. The University takes these statutory obligations seriously and will;

• implement policies, procedures, processes and training to promote ‘data protection by design and by default’.
• have appropriate contracts in place when outsourcing functions that involve the processing of personal data.
• maintain records of the data processing that is carried out across the organisation.
• document and report personal data breaches.
• carry out Data Protection Impact Assessments on ‘high risk’ processing activities.

The University will continue to be regulated by the Information Commissioners Office (ICO) with regards to data protection.

Reporting a data protection breach

If you suspect there has been a breach, you must report it without delay to: Itshelp@hope.ac.uk using subject header: DATA BREACH

For further guidance on what you need to report and what to do if you discover a breach outside of core working hours, please see the University's GDPR Data Breach Procedure.

The University must report a breach of data to the Information Commissioners Office within 72 hours of discovering the breach. DO NOT DELAY INFORMING THE UNIVERSITY IF YOU SUSPECT A BREACH.

Data Protection Complaints: How to Complain

Under UK law, you have the right to complain about how your personal data has been used and protected, and/or how your Data Subject Access Request (DSAR) has been handled.

Complaints about data can be made by Students, Staff, Apprentices or any other person who believes their personal data has been mishandled by the University.

The University’s privacy notices detail how your personal data is dealt with by the University. For more information, please visit https://www.hope.ac.uk/aboutus/governance/dataprotection/privacynotices/. 

The University acts fairly and proportionately in relation to all complaints received. Data protection complaints will be dealt with in accordance with the University’s complaints procedure.

Please attempt to first resolve your data protection complaint informally (Stage 1). If your complaint is not resolved to your satisfaction, please complete the University’s complaint form. You should use the complaint form to send your complaint to caseworker@hope.ac.uk. If you do not use the form or the form has not been completed in full, the University may not consider the complaint until it has been properly completed and submitted.

The University commits to acknowledging your complaint as soon as possible and usually within four working days from receipt.

The University, without undue delay, will investigate your complaint. The University aims to respond to your complaint within 90 calendar days from the date of acknowledgement. Occasionally, there may be reasons why this timescale cannot be met, however, the University will keep you updated as the complaint investigation progresses.

If you remain dissatisfied once the complaint investigation has concluded, you may refer your complaint to the Information Commissioner’s Office (ICO).

Further information

The Information Commissioners Office (ICO) is the UK's independent authority set up to uphold information rights in the public interest and data privacy for individuals.

There are also toolkits available to help staff working with personal data - Information & Cyber Security 

Guidance for university staff

Further information about how to ensure compliance with GDPR can be found in the Staff Guidance on Data Protection Booklet

More practical advice about handling personal data is available in the Data Protection Do's and Don'ts Guide

Data privacy should be considered as part of any project or activity which involves processing personal data to ensure data protection is a key consideration from the outset. A Data Protection Impact Assessment (DPIA) can be used as a tool to assist with this process:

Data Protection Impact Assessment Guidelines

Data Protection Impact Assessment (DPIA) Template

Retention Schedules and Asset Registers

Retention Schedules and Asset Registers are compiled and regularly reviewed by all departments across the University. These are stored on a purpose build internal database which is managed by Governance and Legal Services in conjunction with IT Services. If you have any queries or wish to access information then please contact caseworker@hope.ac.uk 

Further information can be found via our Information Asset Management Policy.

Whilst individual retention schedules are held on our internal database, the overarching University Retention Schedule can be found in our Retention Schedule.