Privacy notice

Covid-19 student data collection privacy notice

Updated on 16 April 2020

How the University uses personal data submitted in the Covid-19 student data collection form

On this page

Why we are asking for this information

The global pandemic of Covid-19 has forced the University to make many changes, the most noticeable for students will be the fact the physical campus has shut down, learning and teaching has moved online and we have been following government advice to self-isolate and encouraging all of our University community to do the same. The University may be the only local point of contact that some students have and as such we need to be in a position to help them. To offer help we require the personal data asked for in the Covid-19 student data collection form. The University takes both its obligations under data protection and its health and social protection responsibilities seriously, as such we have written this privacy notice to explain why this data is required, how we will maintain its security and what our legal basis for processing it is.

How we will use your information

The University will use the information you provide for three main purposes:

  1. It will be used to reach out to students affected by Coronavirus in order to provide support.
  2. Anonymous statistical information will be used by the University’s Coronavirus Taskforce and senior management to plan important University business and further inform the University’s response to Covid-19.
  3. Anonymous statistical information may be shared with the Government (Scottish and UK) if required to aid them in their statistical modelling and planning.

How we will maintain its security

Identifiable data will only be kept for as long as required and in any case not longer than one calendar year from when it has been captured in the form. Then it will be deleted. Anonymous statistical information will be kept for longer. All information will be stored on secure University systems and will have restricted role based permissions for access.

Personal data

The form captures personal data of both the person submitting the form and that of the student who the form relates to. If you submit the form it captures your name and email address and supplies this to the owner of the form. The form itself asks you to provide the student’s name, ID number and current address.

Special categories of personal data

The form captures health data by asking whether the student has Covid-19 symptoms or a confirmed Covid-19 diagnosis. You may have been provided this information through the mitigating circumstances procedure. As part of this procedure, if the mitigating circumstance is particularly serious then the University may have to pass on the student’s details to the University Health Service in order to offer support. Covid-19 is a very serious virus causing a global pandemic and therefore meets the criteria whereby staff members can pass on special category personal data in line with the legal basis for processing below in order for the University Health Service to offer support.

As a courtesy staff members should let the student whose data they are disclosing know that they are undertaking this action and provide them with the link to this Privacy Notice to explain why this is occurring.

Data controller

The University of Dundee will be the data controller for the information you provide. Data will be processed using the University’s core business system Microsoft 365.

Legal basis for processing

The lawful grounds for processing the personal data within this form are:

  • processing is necessary for compliance with a legal obligation to which the controller is subject;
  • processing is necessary in order to protect the vital interests of the data subject or of another natural person;
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The lawful grounds for processing special categories of personal data within this form are:

  • processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;
  • processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 [referring to Article 9 paragraph 3 of the GDPR];
  • processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;  

Your rights

The University respects your rights and preferences in relation to you. If you wish to update, access, erase, limit the use of your information or if you wish to complain about the University’s use of your information please contact the University’s Data Protection Officer in the first instance by emailing You may also wish to contact the Information Commissioner’s Office.

Corporate information category Data protection