University Staff Privacy Notice
Updated on 29 April 2020
To facilitate your employment with the University of Dundee ('the University') and to meet all obligations associated with that employment further to legislation, regulation and convention, the University processes your personal data and special categories of your personal data
How we use your information
Your information is used, in general, for recruitment, administrative, management, legal, pastoral, payroll, pensions, equality and diversity, security and health and safety reasons.
The University must make certain mandatory disclosures of information to bodies such as regulators, law enforcement agencies and local, national and supra-national government bodies. Examples include the Higher Education Statistics Agency, HMRC, UK Visas and Immigration, Electoral Registration Offices, funding councils or other funding bodies, partner organisations, pension providers and competent professional regulators.
The University may also choose to share information with partners, funding bodies or other groups further to its aims and objectives, whilst respecting your rights and freedoms in relation to your personal data.
You may have provided the University with your information or, other agents may have provided your information on your behalf (such as a referee or recruitment company).
Your information may be processed further to your membership of a pension scheme, including the sharing of information between the University and the scheme. There is information on pension schemes at the University on our website. You may also wish to look at the privacy notices provided by your pension scheme.
For more information on the manner in which personal data is used by the University, please see the information on our website:
Additional information is also provided in privacy notices for Schools, Professional Services and specific activities throughout the University and these notices should be considered individually along with this overview.
Your personal data will normally comprise information such as your name, date of birth, ID numbers, addresses, telephone numbers, email addresses, emergency contact information, gender, financial information (for example, payroll and pensions) etc.
Special categories of personal data
Special categories of personal data processed by the University will normally include equality and diversity monitoring information (for example, race, ethnicity, gender identity, religion, sexual orientation, pregnancy, paternity leave status, caring responsibilities), disability information, health and welfare information, trade union membership etc.
The University is normally the data controller for the information it holds about you. On occasion, for example, when working in partnership with other organisations, the University may be a joint data controller (both organisations direct the processing of your data). The University may, from time to time, act as a data processor (where it processes your information on behalf of another organisation, for example where local trades union officers are permitted to use University systems further to their trades union activities).
Your data will be processed in a variety of University systems appropriate to the purpose for which it is being held or used. These include the HR recruitment system, the HR management system, the finance system, Microsoft 365 products (the University's productivity suite, including email), the VLE, the Library management system, research management systems (for example, Pure), the University website (for example, your professional contact information and biography), security access systems (including door access systems), UoDIT systems (including systems administration or security tools or identity management information), manual files in Schools and Professional Services etc.
The University's service providers may be cloud-based or the information may be stored on servers owned and operated by UoDIT. Cloud-based systems may use infrastructure providers based outwith the European Economic Area. Where the University works with overseas partners, this may also require the transfer of your data outwith the EEA.
For more information on the manner in which personal data is used by the University, please see the information published here – www.dundee.ac.uk/information-governance/dataprotection.
In general, the University asserts that it is lawful for it to process your personal data in relation to your employment as that processing is necessary for one or more of the following reasons:
- for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
- for compliance with a legal obligation to which the controller is subject
- to protect the vital interests of the data subject or of another natural person
- for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Where processing falls outwith the normal course of business the University may, from time to time, seek your consent to process your data for one or more specific purposes.
In general, the University asserts that it is lawful for it to process special categories of your personal data in relation to your employment as that processing is necessary for one or more of the following reasons:
- for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject
- to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
- for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
- for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
- for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to [applicable] conditions and safeguards…
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject
Where processing falls outwith the normal course of business the University may, from time to time, seek your consent to process special categories of personal data for one or more specific purposes.
The University may choose to identify one or more bases for lawful processing in relation to specific activities in this domain. Please see the University website for more information:
The University respects your rights and preferences in relation to your data. If you wish to update, access, erase, or limit the use of your information, please let us know by emailing firstname.lastname@example.org. If you wish to complain about the use of your information please email email@example.com. You may also wish to contact the Information Commissioner's Office.