REF 2029 staff and former staff data collection and privacy notice

About the REF

The Research Excellence Framework 2029 (REF2029) is the system for assessing the quality of research undertaken by UK Higher Education Institutions (HEIs).

REF assessments inform the allocation of research funding, provide accountability for public investment in research, and provide insight into the health and performance of research across the UK.

REF2029 is managed by the REF Team, based at Research England (RE), on behalf of the four UK higher education funding bodies. Research England is part of UK Research and Innovation (UKRI).

The University of Dundee is required to collect and submit information to participate in REF2029. This processing forms part of the University’s public task in conducting research, demonstrating research quality and impact, and contributing to the national assessment of research undertaken by UK Higher Education Institutions.

How we process your personal data

For the purposes of REF2029, the University processes personal data relating to current and former staff who may be included within the University’s REF submission.

Information used for REF purposes may come from existing University records, including information provided through statutory returns such as the Higher Education Statistics Agency (HESA) staff return. The personal data processed may include:

• HESA staff identifier and/or University staff number
• name (initials and surname)
• date of birth
• Open Research and Contributor ID (ORCID), where held
• job title and position
• grade
• contracted hours and full-time equivalent (FTE)
• REF Unit of Assessment
• contract information, including contract type, secondments, periods of unpaid leave and relevant dates
• information about whether personal information should be omitted from published REF information for specific reasons, such as security or commercial sensitivity.

This information is used to:

• determine eligibility for REF2029
• establish links between researchers and submitted research outputs and impact case studies
• prepare, manage and quality assure the University’s REF submission
• meet REF reporting, audit and verification requirements.

Lawful basis for processing personal data

The University processes your personal data under:

• Article 6(1)(e) UK GDPR – This processing is necessary for the University’s participation in REF2029, which forms part of its public task of conducting research, demonstrating research quality and impact, and contributing to the national assessment of research undertaken by UK Higher Education Institutions.

Processing of special category personal data

The University may process special category personal data where this information is required to support REF processes, including equality, diversity and inclusion considerations.

Information may be used to support fair and transparent REF decision-making processes, including equality impact assessments, monitoring of participation and compliance with relevant legal obligations, including the Equality Act 2010.

This may include information relating to:

• disability
• race or ethnic background
• religion or religious belief
• sexual orientation
• gender reassignment
• pregnancy and maternity
• caring responsibilities
• health conditions, including disability-related information or mental health information.

Where special category personal data are processed in connection with employment-related equality and inclusion obligations, the University relies on:

• Article 9(2)(b) UK GDPR – processing is necessary for carrying out obligations and exercising specific rights in the field of employment, social security and social protection law, together with Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018.
   

Where special category personal data are processed for research-related purposes, the University may rely on Article 9(2)(j) UK GDPR – processing is necessary for scientific or historical research purposes or statistical purposes, subject to appropriate safeguards.

Data controller responsibilities

The University of Dundee is the data controller for personal data processed by the University in preparing its REF2029 submission.

When personal data are submitted to UKRI for REF purposes, UKRI becomes a separate data controller for the personal data it receives.

UKRI may share REF data with organisations where necessary to undertake statutory functions connected with research funding and assessment, including:

• Department for the Economy, Northern Ireland (DfE);
• Medr (Commission for Tertiary Education and Research in Wales);
• Scottish Funding Council (SFC);
• Higher Education Statistics Agency (HESA).

Further information about how these organisations process personal data can be found in their respective privacy notices.

Sharing information about you

If you are included within the University’s REF2029 submission, the University will provide relevant information about you to UKRI for the purposes of REF assessment. Information shared may include:

• your name
• date of birth
• staff identifier
• contract information
• REF Unit of Assessment
• information relating to your research contribution and outputs.

This information is not submitted in anonymised form because UKRI requires identifiable information to verify eligibility, assess submissions and undertake quality assurance activities.

Some information may also be shared with University staff involved in preparing, managing, governing, assessing and auditing the REF submission.

Data storage and retention

The University has appropriate technical and organisational measures in place to protect personal data against:

• unauthorised access
• accidental loss
• misuse
• alteration
• unlawful disclosure.

Personal data are stored within approved University-managed systems, which may include Microsoft 365, SharePoint and research information management systems.

Personal data will be retained in accordance with the University’s Records Retention Schedule and applicable legal and regulatory requirements.

REF submission materials published by UKRI may remain publicly available. Published information may include names, job titles and periods of employment where required as part of the REF submission.

Your rights

Under UK GDPR and the Data Protection Act 2018, you have rights in relation to how the University uses your personal data. These include the right to access your information, request correction of inaccurate data, and object to or restrict certain processing.

Further information about your rights, how to exercise them, and how the University processes personal data generally can be found in the University’s Privacy Notices and Data Protection Webpages.

Some rights may be limited depending on the circumstances of the processing and any applicable legal exemptions. Where we are unable to fulfil a request, we will explain the reasons for our decision.

Questions, comments or complaints

If you have questions or concerns about how your personal data are processed for REF2029, please contact the University’s REF Team via [email protected]

You may also contact the University’s Data Protection Officer via [email protected]

If you remain dissatisfied with how your concern has been handled, you have the right to complain to the Information Commissioner’s Office (ICO).