Privacy notice

Safeguarding - Covid Code: Non-Compliance Reporting Form Privacy Notice

Updated on 4 May 2021

This privacy notice sets out how the University will use personal data if you shared through the Covid Code non-compliance reporting form

On this page


The University of Dundee (“UoD”) has developed a Covid Code: non-compliance reporting form (“the Form”) as a way for students, staff and others to report breaches of the UoD’s Covid code of conduct. You can use the form anonymously or choose to disclose your name and contact information.

Alternatively, breaches of the Covid Code can also be reported by sending an email to

Further information about reporting non-compliance with Covid-19 rules can be found on the website here: Reporting non-compliance with Covid-19 rules | University of Dundee

This privacy notice sets out how UoD will use your personal data if you share personal data or information with us through the Form. The UoD is a registered data controller and will use any personal data submitted through the Form in accordance with current UK data protection legislation.

If you are a UoD student or an employee, please also see our general privacy policies for students and staff as well as the Academic and Corporate Governance/University Executive Office privacy notice.

Where does our information come from?

We collect personal data about you through the Form which can be completed online or if you send an email to

We will respond to any reported concerns using the information you have chosen to provide.

What information do we use, and why?

Anonymous reports

You have the option to report your concerns without sharing any identifying information about yourself or others. If you decide to report anonymously then you should not include any of your personal data in the Form.

You should be aware that, whilst it is acceptable to make a report anonymously, unless you provide your name and contact details, it may not be possible for us to investigate your report further as it is likely we will need to speak to you to obtain more information in order to facilitate a full and proper investigation of the alleged breach.  Anonymous reports will be considered but the UoD will be limited in what action it can take.  

Named reports

If you choose to provide personal data in response to any of the questions in the Form, you should understand that we will process that information as described in the table below.

Personal data Purpose
Name, email address, telephone number To be able to contact you for additional information about the breach(s) you have reported and/or to offer you support.
The names and any other information identifying others involved in any incidents that may have occurred or that your concerns relate to. This information will be considered and may be used to take further action under another of the UoD’s processes or procedures such as the Student Discipline Procedure or Discipline Procedure relating to staff.

Special category personal data

The UoD does not require any special categories of personal data in the completion of the Form. However, we may hold this information if you choose to provide it to us directly, for instance, your concern may relate to information about health.  

Who will have access to your data?

Access to a Form once it has been submitted will be strictly limited to a small number of UoD staff and will initially be reviewed by them in order to identify who the report should be sent on to for consideration. If a student or member of staff has been named on the Form then the details on the Form will be shared with the relevant members of staff in the relevant School or Directorate. For example, if the breach relates to a student in the School of Health Sciences then the details on the Form will only be shared with the members of staff who have been appointed to consider and address Covid Code breaches in that School.

In some circumstances we may share your personal data and details of your report with relevant UoD members of staff, such as those in Student Services, in order to provide you with support.

Unless you ask us to do so, your personal data will not be shared with any third party. You should note, however, that there may be certain circumstances in which we may be required to share your personal data without your consent to third parties, such as the police or social services, in an emergency or as required by law.

Data will be processed using the UoD’s business systems. These include Microsoft 365, Teams and OneDrive. For more information about the systems that UoD uses, please email

What is the legal basis for using your data?

The UoD has considered that it is lawful to process personal data for the purposes of reviewing and addressing any Concerns you have raised on the following bases:

  • you have consented to it
  • it is in our legitimate interests
  • it is necessary to protect the vital interests of the data subject or of another natural person
  • for compliance with a legal obligation
  • to fulfil a contract we have with you or others.

Please note that you can withdraw your consent at any time and if you would like to do that please email:

If you do share any special category data via the Form then it may be processed on the following bases:

  • you have given explicit consent
  • it is necessary to protect the vital interests of the data subject or of another natural person
  • there are reasons of substantial public interest which may be:
    • preventing or detecting lawful acts
    • protecting the public
    • counselling
    • support for individuals with a particular disability or medical condition
    • safeguarding children and individuals at risk.

Your rights

The UoD respects your rights and preferences in relation to you. If you wish to update, access, erase, or limit the use of your information please let us know by emailing:

If you wish to complain about the UoD’s use of your information please contact the UoD’s Data Protection Officer in the first instance by emailing You may also wish to contact the Information Commissioner’s Office.

Corporate information category Data protection