Privacy notice

Test and Protect and Covid-19 information: privacy notice

Updated on 14 September 2020

How the University process personal data of staff and students relating to the Covid-19 Test and Protect scheme

On this page


As students and staff move about our campuses, it is essential to follow University and Government guidance about hygiene, face coverings and social distancing. In order to ensure that the University complies with its responsibilities to ensure the health and safety of our staff, students and others we will be cooperating with the Scottish Government’s Test and Protect scheme and Government advice about collecting data. This privacy notice sets out how this will affect you. 

What is Test and Protect?

Under the Test and Protect scheme the University may collect your contact details and, when required, supply these to NHS Scotland and statutory partners. This will happen if NHS Scotland believes that you have been in contact with someone who has tested positive for Covid-19. It is important that we pass on these details so that people can be contacted and, if required to self-isolate, help stop the spread of the virus.

It is important that we maintain up to date contact details for you, Scottish government guidance asserts that you have a responsibility to inform us of any changes to these. Please contact HR or update your details on evision.

What details will be passed on and how will these be collected?

Guidance from the Scottish Government requires us to keep records of staff and students who have attended on-site classes and activities. We also need to keep records of visitors and contractors. These records will be kept via swipe cards (for example via the entrance and exit systems or attendance monitoring systems), using the QR system that will be in place, in other digital formats or on hard copy.

 The University currently records information about people who enter some buildings or rooms on our campuses. Examples of these include the Library and certain classrooms, lecture spaces and offices. These records can be linked to your staff or student record to obtain contact details.

On other occasions staff, students, visitors and contractors will be required to give their details to the person organising the event or activity or fill in a simple form using a QR code. These details will include:

  • The date and time of your arrival and departure and location
  • Your name
  • A telephone contact (or if this is not available an email address or address)

Regardless of how the records are kept, we will only pass the above information on to NHS Scotland and only if requested by them.

Public Health Scotland also requires the University to collect data on and maintain records of local Covid-19 cases to assist the containment of the virus, to determine the potential scale of outbreaks and to see if linkages can be established between cases. We ask all staff and students to complete a Covid-19 Self Reporting Form if you have a known or suspected case of Covid-19. This will help the University safely manage any potential outbreaks. The University may pass information to the NHS if requested.

What is our lawful basis for collecting and sharing this data?

We are supporting the NHS in its public task of controlling the spread of Covid-19 and our public task as a university in providing a safe learning environment. The lawful grounds for processing these personal data are:

  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  • in some circumstances, the processing is a legal requirement, for example, under the Health Protection (Coronavirus) (Restrictions) (Scotland) Amendment (No. 11) Regulations 2020.

It is a legal requirement to supply contact details where hospitality is involved (for example, in cafes). In other premises, the expectation is that you will supply your contact details, or you will not be able to enter the premises or take part in the activity.

How long will this information be kept for?

Other privacy notices detail how long data is kept which is collected for purposes other than Test and Protect, see Information which is collected for the purposes of Test and Protect will be kept for 21 days. The data received through the QR code form will only be processed by the University Outbreak Management Team. Covid Self-Reporting forms will be kept for 3 months from the date of receipt. All data will be held and destroyed securely.

Data controller

The University of Dundee will be the data controller for the information you provide. Data will be processed as described above.

Your rights

The University respects your rights and preferences in relation to you. If you wish to update, access, delete or rectify any inaccurate data or if you wish to complain about the University’s use of your information please contact the University’s Data Protection Officer in the first instance by emailing You may also wish to contact the Information Commissioner’s Office.


Data protection
Corporate information category Data protection