Staff Privacy Notice

This Notice explains how the University will collect and use staff personal data, how we share it, how long we keep it for and what your rights are in relation to it. This notice covers the use of your personal data if you are:

• A current member of staff;
• An applicant for a job at the University of Leeds;
• A former employee;
• A consultant or contractor (including honorary or visiting contracts).

We are the data controller for personal data that we process about you. Throughout this Notice, “University”, "we", "our" and "us" refers to the University of Leeds of Leeds, LS2 9JT, "you" and “your” refers to any current or former member of University staff and to job applicants.

This notice does not form part of any contract of employment.

It is important that you read this privacy notice together with other applicable privacy notices.

We obtain personal data about you from the following sources: 

• from you e.g. when you apply to the University through your application form and recruitment process; 

• from other University staff and 3rd parties where required in relation to your application and contract of employment;  

• from 3rd parties where additional information is required about your health, eligibility to work, pension statements etc.

Most data that we ask for is in relation to the administration of your contract of employment.  If you do not provide us with information that you are contractually obliged to provide then we may not be able to continue with your employment or offer certain services or support. 

The usual categories of personal data we expect to process about you include (but are not limited to): 

• Biographical data to help us identify you, including contact details (and details of your next of kin, trusted contact or any life assurance beneficiaries) and photographic identification;

• Records about your recruitment, including your job application , your qualifications/education, references, requests for special arrangements, communications regarding our decisions, and relevant committee and panel reports;

• Employment data in relation to the administering and assessment of your contract, including your working pattern, salary, benefits and entitlements and your right to work status; 

• Training and development records and information relating to your performance in the role;  

• Records regarding grievances, disciplinary proceedings or investigations prompted by, involving or relating to you;

• Data about your ethnicity, gender, religion and sexual orientation. (This is classed as “special category data”); 

• Health-related data including in relation to periods of absence, occupational health referrals, applications for disability support and in relation to staff support services. (This is also special category data);

• Bank and pension details in order that we can process payments and verify in accordance with financial sanctions regulations; 

• Communications that you have with us, and communication that we have with 3rd parties about you; 

• Details of any relevant criminal convictions, allegations or charges that we ask you to declare or which are reported to us, and of any Disclosure and Barring Service checks that we request.  More information is available here: Staff Information on Criminal Records;

• Computing and email information, including login information for our IT systems, IP address(es), equipment allocated to you and records of network access. 

In general terms, we process your personal data for the administration and delivery of your contract of employment with us, and to facilitate your use of our services and facilities. 

As part of the University’s business continuity and critical incident management planning we may use your personal contact details to relay time sensitive information to you. 

We also process your personal data in order to understand the types of interactions we have with staff and applicants and to enhance the support that we can provide.  Where we anonymise your data we will continue to use it for statistical analysis without informing you.  

We may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests. 

The University will often need to share your personal information internally with other colleagues to carry out day to day activities related to your job role and/ or to administer the working relationship with you.  This information is shared sensitively and on a “need to know” basis.  

The University will share some of your information externally, including publishing some details on University websites.  The University may also need to share your personal information with third parties where we are required to by law or there is a legitimate interest in doing so.  

We do not, and will not, sell your data to third parties.  

To help us administer your contract of employment we will use third parties to help process your data (e.g. in relation to your pension fund). Where this is the case we will ensure that we have arrangements in place to ensure the safe use of your data. 

The University has also published separate policies and guidance which may be applicable to you in addition to other privacy notices. It is important that you read this privacy notice together with other applicable privacy notices. 

The other relevant privacy notices include:  

• Advancement Privacy Notice 

• Website and Cookies 

• Information Protection Policy 

• AI use guidance 

• University retention schedule 

This is where we may make decisions automatically about you without human intervention.  

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. 

We will from time to time communicate with you by email, post and telephone about various services provided by the University. If, at any stage, you are concerned about the content of these communications, e.g. marketing information that you don’t think is relevant to you, or you wish to change the method of communication, please use the unsubscribe function in the correspondence you have received.  We will however continue to contact you about matters relating to and ancillary to your contract of employment. 

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  In addition, we limit access to your personal information to those employees, agents, contractors and other 3rd parties who have a business requirement to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are required to do so. 

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

• withdraw consent at any time where that is the legal basis of our processing; 

• access your personal data that we process; 

• rectify inaccuracies in personal data that we hold about you; 

• be forgotten, that is your details to be removed from systems that we use to process your personal data; 

• restrict the processing in certain ways; 

• obtain a copy of your data in a commonly used electronic form; and 

• object certain processing of your personal data by us. 

• You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see the ICO Website 

Please be aware that these rights are subject to certain conditions and exceptions as set out in your employment contract, data protection legislation, employment law and other relevant legislation.  

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, withdraw your consent to any processing, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer in writing and they will explain any conditions that may apply. 

It is important that the personal information we hold about you is accurate. Please keep us informed if your personal information changes – including the naming of any beneficiaries - during your employment with us.

Here is a brief explanation of the grounds on which we rely to process your personal data. 

• Contract: necessary for the performance of your employment contract – on many occasions the University will process your data to enable it to meet its commitments to you. 

• Legal obligation: the University must process, and share, some personal data in accordance with the legal obligations placed on it.  

• Public task: processing necessary for the performance of a task carried in the public interest – the University is an educational establishment and much of its activity is conducted in the public interest (including your interest and the interest of others). 

• Legitimate interests: processing is necessary for the purposes of the legitimate interest of the University or a 3rd party subject to overridden interests of the data subject. 

• Vital interests: for the purpose of protecting the vital interests of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies. 

• Consent: on specific occasions the University will only process certain data if you consent.

Sometimes the University will need to process special category data about you; the grounds on which we rely to do this are: 

• Where it is required by law in relation to employment, social security and social protection. 

• Where you have made the data public. 

• For archiving, research and statistics purposes.

Sometimes the above grounds will overlap. The University also reserves the right to rely upon other grounds that are not referred to in the table.  

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data.  Please see The ICO website.  

If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice, please contact our Data Protection Officer [email protected]  

Our general postal address is University of Leeds, Leeds LS2 9JT, UK. 

Our data controller registration number provided by the Information Commissioner's Office is Z553814X.  

We shall inform you of any changes to this Notice. Notification will be through the appropriate medium of communication e.g. where our main contact with you is by email we will email you.