REF 2029 non-staff data collection and privacy notice

About the REF

The Research Excellence Framework 2029 (REF2029) assesses the quality, significance and impact of research undertaken by UK Higher Education Institutions.

As part of REF2029, universities submit evidence demonstrating the contribution and impact of research beyond academia through impact case studies and other submission materials.

The University may process personal data relating to individuals who contribute to:

• impact case studies
• evidence supporting research outputs
• environment statements
• other REF submission materials

The REF is managed by the REF Team, based at Research England (RE), on behalf of the four UK higher education funding bodies. Research England is part of UK Research and Innovation (UKRI).

How we process your personal data

The personal data processed for REF2029 may include your:

• name
• job title
• organisation or affiliation
• professional email address
• quotations
• testimonials
• interview information, including notes, recordings or transcripts where applicable
• statements or other supporting evidence provided to demonstrate research impact

This information may be used to demonstrate the reach, significance and impact of research undertaken by the University.

Personal data may relate to individuals who have experienced, contributed to, collaborated with, benefited from, or otherwise have knowledge of the impact arising from the University’s research.

Lawful basis for processing personal data

The University processes your personal data under:

• Article 6(1)(e) UK GDPR – This processing is necessary for the University’s participation in REF2029, including the preparation of impact case studies and other evidence demonstrating the reach and significance of research undertaken by the University.

Processing of special category personal data

The University does not normally request or require special category personal data from REF contributors. However, special category personal data may occasionally be included where it forms part of evidence provided to demonstrate research impact.

Where special category personal data are processed, the University will rely on Article 9(2)(e) UK GDPR – processing relates to personal data which are manifestly made public by the data subject.

Where appropriate, the University may also rely on:

• Article 9(2)(j) UK GDPR – processing is necessary for scientific or historical research purposes or statistical purposes, subject to appropriate safeguards.

Sharing your personal data

Your personal data may be shared with:

• University staff involved in preparing and managing the REF submission
• UKRI and organisations involved in REF administration, assessment and audit
• research collaborators or partners where necessary to support REF evidence

In preparation for REF2029, the University will share relevant information contained within impact case studies and other submission materials with UKRI.

This may include:

• your name
• job title
• organisation or affiliation
• quotations
• statements or other evidence demonstrating research impact

Impact case studies and other REF submission materials may be published by UKRI and made publicly available.

Published information may include your name, job title, organisation and relevant quotations where these are necessary to evidence research impact.

Storage and retention of your personal data

The University has appropriate technical and organisational measures in place to protect personal data against:

• unauthorised access
• accidental loss
• misuse
• alteration
• unlawful disclosure.

Personal data are stored within approved University systems, which may include Microsoft 365, SharePoint and research information management systems.

Information will be retained only for as long as necessary for the purpose for which it was collected and in accordance with the University’s Records Retention Schedule.

Your rights

Under UK GDPR and the Data Protection Act 2018, you have rights in relation to how the University uses your personal data. These include the right to access your information, request correction of inaccurate data, and object to or restrict certain processing.

Further information about your rights, how to exercise them, and how the University processes personal data generally can be found in the University’s Privacy Notices and Data Protection Webpages.

Some rights may be limited depending on the circumstances of the processing and any applicable legal exemptions. Where we are unable to fulfil a request, we will explain the reasons for our decision.

Questions, comments or complaints

If you have questions or concerns about how your personal data are processed for REF2029, please contact the University’s REF Team via [email protected]

You may also contact the University’s Data Protection Officer via [email protected]

If you remain dissatisfied with how your concern has been handled, you have the right to complain to the Information Commissioner’s Office (ICO).