Guidelines for Staff

Tips for Staff

Do not retain excess data, just record what you need
Keep data up-to-date and accurate
Keep data safe and secure: keep offices/filing cabinets locked, password-protect your computer and/or device, and never record or share your password.
Back up digital files regularly
Do not disclose personal data to a third party without the data subject’s consent
Regularly review the data you hold and dispose of data you no longer need by confidential shredding or deletion.
Take extra care with sensitive data such as medical or financial information, and only store sensitive data on computers or devices which are password protected and have suitable encryption software installed.

Eight Rules of Data Protection

Obtain and process data fairly
Keep data only for one or more specified and lawful purposes
Use and disclose data only in ways compatible with the purposes for which it was initially given
Keep data safe and secure
Keep data accurate, complete and up-to-date
Ensure that data is adequate, relevant and not excessive
Retain data no longer than is necessary for the specified purpose or purposes
Provide a copy of his/her personal data to any individual, on request

Scenarios

If you have to share personal data in the course of performing University functions, make sure you only share the data with colleagues who need to know it.

If a parent/guardian of a student, who is under the age of 18, contacts you to request their son or daughter's personal data (e.g. exam results, registration details) you should not release that data unless you have the written consent of the student to do so.

If you are emailing more than one student at a time, you should always use the "Bcc" option to avoid sharing students' personal data (email address) with other students. Student email lists should not be shared with class reps or student societies. If a class rep wants to email all the students in their class, you could offer to forward the email on their behalf.