Skip to main content

Data Protection

Data Protection is the responsibility of all staff who handle personal information of our staff or our students.

Overview

Data Protection is the responsibility of all staff that handle personal information of our staff and our students (data subjects). Below are some key points from the University of Sunderland Data Protection Policy.

The Data Protection Policy applies to all staff who handle personal information for or on behalf of the University of Sunderland.

The University will comply with the principles of the UK General Data Protection Regulations when processing personal information.

Personal data will only be processed where one or more legal basis for processing this data applies.

The University will undertake an assessment of new or significantly changed methods of processing to ensure risks of the processing can be understood and effectively managed.

The minimum information classification applied to personal data will always be restricted, and for special category information, confidential.

The University will ensure that all requests relating to personal data are handled in line with the expectations of the UK General Data Protection Regulations.

In the event of a data breach, the University will assess the severity of the breach and, where applicable, will report the incident to the Information Commissioner's Office no later than 72 hours after becoming aware of the breach.

The University will provide mandatory training in Data Protection to all staff.

1. Introduction and purpose

The University of Sunderland gathers and processes personal information about students, staff, alumni, contractors, applicants, and other individuals (“data subjects”) to fulfil its educational and administrative functions.

The University is registered as a data controller with the ICO (registration number Z6120473).

This policy sets out the University’s approach to collecting, handling, and storing personal data in compliance with:

  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018 (DPA 2018)
  • Data (Use and Access) Act 2025 (DUAA) including legislative changes(opens in new tab) effective February 2026.

The University of Sunderland ensures that:

  • Processing of personal data complies with UK GDPR, DPA 2018, and DUAA provisions
  • Individuals’ rights are respected and protected
  • Processing is transparent and accountable
  • Risks to personal data are identified and mitigated
  • The University safeguards itself against potential breaches, fines, or regulatory enforcement.

The DUAA updates clarify lawful bases for processing, automated decision-making, subject access requests, and proportionality in data management. The University applies these changes proportionately across operations.

2. Scope

This policy applies to:

  • The University of Sunderland and all subsidiary companies
  • All staff, contractors, suppliers and third parties processing data on behalf of the University
  • All personal data held relating to any identifiable individual, in any format (electronic, paper, verbal, or other.

DUAA provisions are applied proportionately to ensure compliance without imposing unnecessary burdens on university processes.

3. Definitions

Personal data: information relating to an identifiable living individual

Processing: any operation performed on personal data, including collection, storage, use, or destruction

Data Controller: determines the purposes and means of processing personal data

Data Processor: Processes personal data on behalf of the controller

Personal data breach: any accidental or unlawful destruction, loss, alteration, disclosure, or access of personal data.

4. Roles and responsibilities

4.1 University responsibilities

  • Ensure compliance with UK GDPR, DPA 2018, and DUAA
  • Maintain records of processing activities
  • Conduct Data Protection Impact Assessments (DPIAs) for new or significantly amended processes
  • Report personal data breaches to the ICO within 72 hours, where required.

4.2 Board of Governors

  • Ultimately responsible for legal compliance across the University and subsidiaries.

4.3 Data Protection Officer (DPO) and Information Governance Team

  • Advise on data protection obligations under UK GDPR, DPA 2018, and DUAA
  • Monitor compliance and oversee audits
  • Provide guidance on DPIAs
  • Acts as liaison with the ICO
  • Handle data subject requests, including those impacted by DUAA updates.

4.4 Information security

  • Develops technical security standards
  • Monitors the security of systems and third-party services
  • Ensures Supplier Information Security Assessments (SISA) are performed.

4.5 Staff responsibilities

  • Handle personal data only for legitimate purposes
  • Ensure data is accurate, secure, and confidential
  • Report suspected breaches immediately
  • Complete mandatory training, including DUAA-related updates.

5. Policy details

5.1 Data protection principles

The University applies the following principles, in line with UK GDPR, DPA 2018, and DUAA:

  • Lawfulness, fairness, and transparency
  • Purpose limitation
  • Data minimisation
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality.

DUAA updates are considered when applying these principles, particularly regarding:

  • Legitimate interests
  • Automated decision-making
  • Subject access requests and proportionality in processing.

5.2 Lawful basis for processing

Personal data will only be processed where one or more lawful bases exist:

  • Consent
  • Performance of a contract
  • Legal obligation
  • Vital interests
  • Public task
  • Legitimate interests
  • Special categories require explicit consent or another lawful basis under Article 9(1) of UK GDPR
  • DUAA amendments are applied proportionately to clarify and document lawful bases, particularly for automated or large-scale processing.

5.3 Data breaches

  • All breaches are assessed, documented, and managed by the Information Governance Team
  • High-risk incidents are reported to the ICO within 72 hours
  • DUAA provisions on breach management and reporting are incorporated proportionately.

5.4 Impact assessments

  • DPIAs are conducted for new or significantly changed processing activities
  • Privacy Impact Assessments (PIAs) or SISA are used for internal and external systems, respectively
  • DUAA encourages proportional risk assessment, which the University applies when evaluating potential processing.

5.5 Classification and security

  • Minimum classification for personal data: Restricted
  • Special category data: Confidential
  • Security controls are applied according to classification and DUAA guidance(opens in new tab).

5.6 Data subject requests

  • Subject access requests are handled within 30 calendar days
  • Requests are processed in accordance with UK GDPR and DUAA provisions
  • Information on purpose, recipients, and disclosure is provided as required.

6. Training and education

Mandatory induction training for all new staff and contractors:

  • Refresher training every two years
  • Access to personal data is withheld until training is completed
  • Training includes UK GDPR, DPA 2018, and DUAA updates to ensure awareness of new legislative obligations.

7. Policy review

  • Reviewed at least every two years or upon legislative change, including DUAA updates
  • Ensures proportional application of DUAA obligations
  • Monitors compliance with legal requirements and internal procedures.

8. Appendices

Appendix 1 – UK GDPR Principles

There are six processing principles in the UK GDPR; in full, they are:

Personal data shall be:

  • Processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and transparency)
  • Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’)
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)
  • Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’)
  • Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation to safeguard the rights and freedoms of the data subject (‘storage limitation’)
  • Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Appendix 2 – Lawful Bases for Processing Personal Data

Processing of personal data shall be lawful only if and to the extent that at least one of the following applies:

a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes

b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract

c) Processing is necessary for compliance with a legal obligation to which the controller is subject

d) Processing is necessary in order to protect the vital interests of the data subject or of another natural person

e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.

Point (f) shall not apply to processing carried out by public authorities in performance of their tasks.

Recognised legitimate interests (introduced by the Data (Use and Access) Act 2025):

Processing is necessary for a recognised legitimate interest defined in legislation (for example, safeguarding, crime prevention, or responding to emergencies). In these cases, organisations do not need to conduct a legitimate interest balancing test.

Appendix 3 – Lawful bases for processing special category personal data

1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited, unless one of the following applies:

a) The data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provides that the prohibition referred to in paragraph 1 may not be lifted by the data subject.

b) Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subjects.

c) Processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.

d) Processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects.

e) Processing relates to personal data which are manifestly made public by the data subject.

f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

g) Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

h) Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care system and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 2.

i) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy

j) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

2. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another personal also subject to an obligation of secrecy under Union or Member State law or rule established by national competent bodies.

Appendix 4 – Duties under the Data (Use and Access) Act 2025

Staff must ensure that:

  • Lawful bases for processing are clearly recorded
  • Subject access requests are handled proportionately, with decisions evidenced
  • Automated decision-making is documented and reviewed where required
  • DPIAs consider DUAA requirements around risk, proportionality, and safeguards
  • Supplier arrangements include DUAA-aligned contractual and security obligations
  • Breach decisions and escalation are documented
  • Compliance evidence is retained for audit.

Version 2.1 – effective August 2026.

Next review due – August 2027.

Author – Governance, Risk and Compliance Officer.