Privacy notice

Privacy notice for Research and Innovation Services

Updated on 4 May 2020

How Research and Innovation Services process the personal information of staff, students, and other stakeholders

On this page

How we use your information

Research and Innovation Services provides professional services to support the University’s research activities and to promote engagement with industry and other organisations. They work with internal and external stakeholders in this domain in areas such as research contracts, partnerships funding bids and the management and allocation of research funds (in partnership with colleagues in Research Finance).

These activities can and do involve the processing of personal information about research-active staff and students and the professional contact information of external stakeholders.

This information is used throughout Directorate activity including in the promotion of the University, applications for research funding, negotiations with external partners, knowledge exchange activity and events, the management of research projects and associated funds, providing information to funding bodies and the management of the intellectual property.

Personal data

Personal data will include identifiers such as name, email address, correspondence address and date of birth. Depending on the process it may include data such as professional or academic references, reports on performance, or other aspects of individual circumstances related to the activities noted above.

This information may be provided by individuals or may be sourced from University systems such as the HR system or the student records system, or maybe provided by agents or representatives on behalf of data subjects.

Sensitive (special categories) of personal data

Special categories of personal data are not normally processed by Research and Innovation Services.

Data controller

The data controller for personal data used in this Directorate is normally the University of Dundee. However, activities in this domain may mean that the University acts as a data processor on behalf of others or as a joint data controller, depending upon the nature of any partnership or relationship.

Data will be processed using the University’s business systems. The University has contracts with providers for their cloud services to safeguard your data.

Data will also be stored in other key University systems such as the human resources system, the finance system and the student records system. Data in the human resources system and the finance system is stored on the University’s servers. The finance system will move to a cloud-based provider (TechnologyOne) during 2018. The University has contractual controls in place to safeguard data in this system.

Lawful processing

The lawful grounds for processing personal data within Research and Innovation Services are normally:

  • the data subject has given explicit consent to the processing of those personal data for one or more specified purposes
  • processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract
  • processing is necessary for compliance with a legal obligation to which the controller is subject
  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

The lawful grounds for processing special categories of personal data within Research and Innovation Services are normally:

the data subject has given explicit consent to the processing of those personal data for one or more specified purposes;

  • processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
  • the processing relates to personal data which are manifestly made public by the data subject
  • processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
  • processing is necessary for reasons of substantial public interest
  • processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1)

Your rights

The University respects your rights and preferences in relation to your data. If you wish to update, access, erase, limit or complain about the use of your information, please let us know by emailing You may also wish to contact the Information Commissioner’s Office.


Data Protection
Corporate information category Data protection