Data protection for staff
Structure and governance
As a member of staff, the University of Portsmouth will collect your personal data to record your time as an employee and ensure that you are paid.
What data do we process?
We collect the following personal data from you before you start working with us:
- Your name
- Contact details
- Emergency contact details
- Date of birth
- Country of nationality and birth
- Academic qualifications
- Previous employment details
- Details of any disability
- Details of any criminal convictions
- Contact details for referees
- Special category data such as country of birth, nationality and details of physical and mental health for equal opportunities monitoring
Disclosure of your personal data to third parties
We will only disclose your personal data:
- Where you give written consent for the disclosure
- When the University is under a legal requirement to provide information (e.g. Higher Education Statistics Agency or HESA)
- If required by the police or other agencies investigating a criminal offence
It is not possible to list every purpose for which your data will be used, but this will only ever be in relation to University business.
For further information, please read the Data Protection Statement: Staff (PDF)
How long will we keep your personal data?
Your staff record will be retained for six years after the termination of your employment. After this, only those details necessary to identify you and to show that you worked at the University will be kept.
Your responsibilities as a data subject
We need you to tell us if any of your details change so that we can keep your records up to date.
Don't give your staff username or computer passwords to anyone else. This will limit the possibility of confidential systems being accessed by anyone who is not authorised to do so.
If you are involved in any research work at the University or are in a position where you might come into contact with other people's personal data, please remember to treat that information in confidence. All data must be handled in line with basic data protection principles and you must not to access any data that you do not need to complete your work.
Processing data: Staff responsibilities
As a member of staff, it is your responsibility to treat personal data confidentially. You must ensure that computer records are password protected and papers locked away when not in use. You must not disclose a student or staff member's personal data to any one without that person's consent, except in the instances mentioned below.
You must be aware of the data protection principles and must adhere to them whenever processing data. Failure to follow the data protection policy can result in a data breach. This may result in disciplinary proceedings within the University.
Disclosure of information
As staff, you will often receive enquiries from third parties asking for information. You should not give out information to anyone or confirm any information given to you by the third party, except in the following instances:
- To state what qualification a student has received. This information is already in the public domain through the graduation programme and so can be confirmed.
- Where a student or member of staff has given permission either by contacting the University directly to ask us to provide the information (e.g. for a reference), or where we have a copy of a statement signed by the student or the member of staff authorising someone to check on their details (e.g. when an employment agency is checking the validity of the student's or member of staff's application).
- Where the information is required by law (e.g. a request from a police officer).
- Where the vital interests of a student or member of staff are involved (e.g. where a student or staff member is very ill and requires immediate medical treatment).
Subject Access Requests
Students and members of staff are entitled to ask to see the information the we hold about them. This is called a Subject Access Request (SAR) and should be referred to the information disclosure manager.
When to contact the Information Disclosure Manager
If you are ever uncertain whether to release the information requested, please contact the University's Information Disclosure Manager, Samantha Hill, on 023 9284 3642 to discuss the matter.
Please note that any request made from the police or relating to immediate medical treatment should always be referred to the information disclosure manager.
Requests from relatives
You will most probably receive requests from parents or relatives of students for information about their son, daughter, partner or relative.
Students' relatives do not have an automatic right to any information about a student. In cases where you are asked to provide information or contact details, offer instead to pass a message along to the student asking him/her to contact the person trying to contact them. This also applies to other students trying to contact their colleagues.
Requests from sponsors
In the case of sponsored students, the sponsors do not have an immediate right to information about the student they have sponsored unless that right has been agreed in a contract with the student. It is important that you ask to see copies of the sponsorship contract and check details of prior agreement given by the student to pass on the information. If the University does not hold a copy of the prior agreement, you must contact the student concerned before passing any details to a sponsor.