What is a Privacy Notice?
A privacy notice describes to individuals (data subjects) when, why, where and how their personal data and special categories data are used by the University. Individuals must be provided with a privacy notice for the processing of personal information to be demonstrably fair and transparent.
When do I need one?
The University has produced a separate Student Privacy Notice and Staff Privacy Notice which will set out in detail the uses made of each group's personal data. Check first if the use of the data within your project/initiative is already included in these privacy notices.
If your processing is not covered, then you will need to provide a specific privacy notice to data subjects. This must include the legal basis for processing personal information.
What should I include?
- Identity and contact details of the Data Controller (the University of Glasgow) and the Data Protection Officer
- Details of the information being processed, the purpose and the legal basis for processing
- Details of any other organisation or person who may access the data
- Details of transfers to countries outside the European Economic Area (EEA) and the safeguards in place (e.g. whether a data sharing agreement is in place)
- Information on the retention period or criteria used to determine how long the information will be held
- Details of applicable data subject rights
- Where relevant, the existence of automated decision making, including profiling and guidance on how decisions are made, the significance and resultant consequences
- Where consent is being relied upon as the legal basis for processing, the right to withdraw this consent any time
- Right to complain to the Information Commissioner’s Office
Privacy Notice template
Download the University's recommended template
- Privacy Notice template & Privacy Notice checklist (available to University of Glasgow staff with GUID login)
- Privacy Notice guidance from the Information Commissioner’s Office (ICO)