Data Privacy Notice

Version 1.4 – Updated August 2025   

  This privacy notice aims to communicate how we use your data in a concise manner in accordance with the UK GDPR Article 12, whilst meeting our statutory notice obligations (Articles 13 and 14). If you would like to know more then please contact our Data Protection Officer via the Data Protection web form or by emailing dataprotection@kent.ac.uk.

Data Protection Register

Our entry in the Information Commissioner's Office (ICO) Data Protection Register (Number Z6847902 [3]) contains details of types of information processed, who the information is about and who the information is shared with.  

Definitions

Engagement - within this document, the term ‘engagement’ includes appointments under a contract of employment and/or other types of contract such as a worker contract or an external examiner or invigilator contract. It also includes honorary or visiting positions, honorary staff associates, contractors and/or sub-contractors plus other arrangements that require the creation of an IT account or HR/Payroll record.

Staff - Within this document, the term ‘staff’ includes individuals engaged under any of the arrangements described above.

Job - Within this document, the term ‘job’ includes any tasks, duties or activities carried out as part of the engagement arrangement.

How we collect your information

We collect many different types of personal data about you for lots of reasons. We cannot administer our employment or other relationship with you without your personal data. Where we don’t need your personal data, we will make this clear, for instance we will explain if any data fields in our forms or staff survey processes are optional and can be left blank.

Further details of the personal data we collect, where we get it from and what we do with it are set out in  Schedule 1.

You provide us with personal data directly when you apply for engagement with us, when you complete our application forms or correspond with us and in the course of performing your job. We also create some personal data ourselves and obtain some personal data from other sources. We obtain it from other people and organisations, including some public sources, such as publically available directories and online resources, your emergency contacts, your use of University provided assets, systems and platforms, your line manager and co-workers, your dependants and beneficiaries and third party benefits providers.

If any of the personal information you have given to us changes, such as your contact details, please inform us without delay by updating your record in Staff Connect  https://staffconnect.kent.ac.uk

Within this document, the term ‘engagement’ includes appointments under a contract of employment and/or other types of contract such as a worker contract or an external examiner or invigilator contract. It also includes honorary or visiting positions, honorary staff associates, contractors and/or sub-contractors plus other arrangements that require the creation of an IT account or HR/Payroll record. Within this document, the term ‘staff’ includes individuals engaged under any of the arrangements described above

The purposes of processing your information

We process your personal data for particular purposes in connection with your engagement with us, and the management and administration of our business.

We are required by law to always have a permitted reason or justification (called a “lawful basis”) for processing your personal data. There are six such permitted lawful basis for processing personal data. The table at Schedule 3 sets out the different purposes for which we process your personal data and the relevant lawful basis on which we rely for that processing.

Please note that where we have indicated in the table at Schedule 3 that our processing of your personal data is either:

• necessary for us to comply with a legal obligation; or
• necessary for us to take steps, at your request, to potentially enter into an engagement with you, or to perform it

 If you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our engagement with you.   

We may also convert your personal data into statistical or aggregated form to better protect your privacy, or so that you are not identified or identifiable from it. Anonymised data cannot be linked back to you. We may use it to conduct research and analysis, including to produce statistical research and reports. For example, to help us understand the diversity of the University’s workforce and to make submissions to recognised diversity bodies such as Advance HE (for Athena Swan).

Once your engagement with us has ended, after a period of time your data will be removed from our HR systems and your basic details will be archived in a secure system visible to only a few members of HR. This will allow us to continue to provide engagement confirmation references for you and/or respond to other requests for basic engagement information.

Special category personal data (including criminal data)

We are required by law to treat certain categories of personal data with even more care than usual. These are called sensitive or special categories of personal data and different lawful bases apply to them.

The table at Schedule 4 sets out the different purposes for which we process your special category personal data and the relevant lawful basis on which we rely for that processing. For some processing activities, we consider that more than one lawful basis may be relevant – depending on the circumstances.

Who your information is shared with

We ask third parties (e.g. service providers and/or sub-contractors) to carry out certain business functions for us, such as the administration of our payroll for staff based in Europe and the hosting of our HR IT systems (which will include maintenance, development and upgrade). These third parties will process your personal data on our behalf (as our processor). We will disclose your personal data to these parties so that they can perform those functions, however we will enter into a written contract imposing appropriate security standards on them to ensure that they have appropriate security standards in place to protect your personal data. The table at Schedule 5 provides further details of the key service providers who process staff personal data on our behalf (‘data processors’). 

Your personal data may also be shared between colleagues who legitimately need the information to carry out their duties, for example SAT teams for Athena Swan submissions. Your personal data may also be shared, in limited circumstances, with your Trade Union or nominated representative.

Registration with IT means that a member of staff’s name, department/section, email address and telephone number will appear in the University’s internal email and telephone directory. This information may also appear on externally facing departmental webpages.

Registration for an IT account means that an individual’s name, department/section, email address and telephone number will appear in the University’s internal email and telephone directory. This information may also appear on externally facing departmental webpages.

Staff photographs are used on security cards for the purposes of identification and security. The University may occasionally commission photographs around Campus or at specific University events which could include images of staff for inclusion in promotional material.

We may also share your information with other departments in the University for the purposes of administering your engagement benefits (including salary sacrifice arrangements).

The University may monitor IT use through user names and log-ins to ensure adherence to the Acceptable Use Policy or for statistical purposes. We also use automated processing (including AI) for monitoring purposes, for example, Microsoft Defender for Endpoint to protect the security of our IT infrastructure. Please see Schedule 5 for further details.   

In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above, in particular:

• if we transfer, purchase, reorganise, merge or sell any part of our organisation or the organisation of a third party, and we disclose or transfer your personal data to the prospective seller, buyer or other third party involved in a transfer of undertaking, reorganisation or merger arrangement (and their advisors); and
• if we need to disclose your personal data in order to comply with a legal obligation, to enforce a contract or to protect the rights, property or safety of our staff, collaborative partners, students or others.

We have set out below a list of the categories of recipients with whom we are likely to share your personal data:

• staff-related benefits providers and other third parties in connection with your benefits (such as pension trustees);
• clients;
• consultants and professional advisors including legal advisors and accountants;
• courts, court-appointed persons/entities, receivers and liquidators;
• partners and joint ventures;
• trade associations and professional bodies;
• security partners including, for example, operators of the University car parks;
• insurers; and
• governmental departments, statutory and regulatory bodies including the Department for Work and Pensions, Information Commissioner’s Office, the police, Her Majesty’s Revenue and Customs, the Office for Students and the Higher Education Statistics Agency.

Further details of the data controllers who we share staff data with are available in Schedule 6.   

We may also share your personal data with third parties, as directed by you.

Finally, the University operates a number of electronic HR systems within which the personal data referred to in Schedule 1 is stored. Managers have access to the personal data of staff in their management hierarchy in order to effectively and efficiently conduct appropriate management of those members of staff. Managers are only granted access to this information on the basis that:

• they are trusted to access the data only at a time, and to the extent, necessary to conduct appropriate management of the relevant staff member;
• they access it in accordance with this privacy notice, the University’s Data Protection policy and the University’s obligations under GDPR;
• they have undertaken appropriate and relevant data protection training; and
• they access the information in accordance with the University’s IT Regulations.

Any inappropriate accessing of personal data could be regarded as gross misconduct.

Where in the world is your personal data transferred to?

If any of our processing activities require your personal data to be transferred outside the United Kingdom we will only make that transfer if:   

• the country to which the personal data is to be transferred ensures an adequate level of protection for personal data as determined by the Secretary of State: 

Department for Science, Innovation and Technology UK adequacy 

What countries or territories are covered by adequacy regulations? (ICO website) 

•  we have put in place appropriate safeguards prescribed by the UK GDPR (or EU GDPR if applicable) to protect your personal data, such as an appropriate contract with the recipient containing the EU Standard Contractual Clauses and the UK ICO Addendum or the ICO’s International Data Transfer Agreement (IDTA). Further information here: Is the restricted transfer covered by appropriate safeguards? (ICO website)   
• the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
• you explicitly consent to the transfer.

How long do we keep your personal data for?

If you are engaged by us we will keep your personal data during the period of your engagement and then, after your engagement with us ends, for as long as is necessary in connection with both our and your legal rights and obligations. This may mean that we keep some types of personal data for longer than others. Full details of our data retention periods are contained in Schedule 2.

We will only retain your personal data for a limited period of time. This will depend on a number of factors, including:

• any laws or regulations that we are required to follow;
• whether we are in a legal or other type of dispute with each other or any third party;
• the type of information that we hold about you; and
• whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

Any personal data contained in any work related correspondence or records may be retained for longer, dependant on the retention period of the file that your personal data is held on.

Automated decision-making, profiling and AI use  

You have the right to be informed about the existence of any automated decision-making (which would include the use of Artificial Intelligence (AI) and include any profiling of you) in cases where the decision significantly affects you or produces legal effects concerning you.  We will provide you with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.  Unless the decision making is necessary for a contract with you, based on your explicit consent or required by law you have the right not to be subject to a decision based solely on automated processing. Where a decision is based on a contract with you or your consent we will implement measures to safeguard your rights and at least the right to obtain human review of the decision.  

We currently use automated processing and AI for network and device security monitoring purposes.  Any activity which results in restriction of a device will involve human intervention to review the security alert automatically generated.

Where our software applications use or are AI enabled these are marked with a * in Schedules 5 and 6 below. 

Generative AI use

We currently have the use of Microsoft’s Copilot Chat available within our Microsoft 365 tenancy for education and accessed using a Kent IT account.  This enables staff and students to get answers to questions via prompts using a chat based interface.  Although staff are instructed not to put personal or sensitive data into Copilot Chat we recognise AI may process personal data in the course of generating responses. We rely on public task as our lawful basis for our core teaching and learning purposes and legitimate interests and (where applicable) legal obligation for incidental processing (e.g. monitoring).  Any retained outputs generated by Copilot Chat (or any other permitted generative AI tool) will be reviewed and verified for accuracy. Staff should be aware that outputs of generative AI systems are statistically informed guesses/inventions rather than facts.   

Microsoft’s privacy and security information for Copilot Chat can be viewed here: 

https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-transparency-note?view=o365-worldwide 

Microsoft’s privacy notice (relevant to Bing enabled searching) is here: https://www.microsoft.com/en-gb/privacy/privacystatement 

We will review our AI and generative AI use and practices to ensure these and any emerging risks are monitored. Limited authorised staff may check audit logs for security monitoring purposes or generate reports which indicate active users (name and email address or IP address and device location).  In the event an information request or complaint is received audit log data (such as time and date of queries and if Bing was used), or prompt and response data may be reviewed.  Prompts and responses can be deleted directly by users, although : https://support.microsoft.com/en-gb/office/delete-your-microsoft-365-copilot-activity-history-76de8afa-5eaf-43b0-bda8-0076d6e0390f  

For more detailed information regarding the use of Generative Artificial Information at the University of Kent, please click here.  

Your rights

You have certain legal rights, which are briefly summarised below, in relation to any personal data about you which we hold.

Your rights: withdrawal of consent

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point.

Your rights: legitimate interests

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Your right to lodge a complaint to the Information Commissioner

You also have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website at https://ico.org.uk/.

For further guidance regarding your rights please see the ICO website: https://ico.org.uk 

You will not have to pay a fee to exercise your rights.  However if your request is unfounded or excessive, we may charge a reasonable fee in line with our Schedule of charges for information requests as detailed on our freedom of information requests page, or alternatively, refuse to comply with the request.  

Please consult our data protection rights page of our website and Data Subject Rights Policy for further information and contact data protection if you would like to make a request.

Further processing of your data

Where required, we will provide further privacy notices to you to ensure that we are transparent, accountable and you have control in how we use your personal information.

Your obligations

The University tries to ensure that the information it holds is accurate and up-to-date. It must, however, rely on indivduals to inform the appropriate office of any change in their personal data. In particular, any change of home address or emergency contact details. This can be done directly in Staff Connect.

As a user you are required to comply with the University's IT regulations for the use of computing facilities. It is also your responsibility, should you hold personal data on others, to ensure that you abide by the terms of Data Protection law.

Contacts

If you have any questions or concerns about the way the University has used your data, or wish to exercise any of your rights, please consult our website: 

https://www.kent.ac.uk/about/assurance-and-data-protection/data-protection-rights-and-subject-access-requests 

The University’s Data Protection Officer can also be contacted at: dataprotection@kent.ac.uk 

Or by writing to: The Data Protection Officer, The University of Kent, The Registry, Canterbury, Kent CT2 7NZ. 

Lawful basis 

We are permitted to process your personal data because...

Purposes of processing

1. You have given your consent to the processing

2. It is necessary to perform your engagement contract

3. It is necessary for us to comply with a legal obligation

4. It is necessary for our legitimate interests or those of third parties

5. It is necessary to protect your vital interests (or those of someone else)

6. It is necessary to perform a task in the public interest or in our official authority

Purposes of processing

1. You have given your consent to the processing

2. It is necessary to perform your engagement contract

3. It is necessary for us to comply with a legal obligation

4. It is necessary for our legitimate interests or those of third parties

5. It is necessary to protect your vital interests (or those of someone else)

6. It is necessary to perform a task in the public interest or in our official authority

Purposes of processing

1. You have given your consent to the processing

2. It is necessary to perform your engagement contract

3. It is necessary for us to comply with a legal obligation

4. It is necessary for our legitimate interests or those of third parties

5. It is necessary to protect your vital interests (or those of someone else)

6. It is necessary to perform a task in the public interest or in our official authority

Purposes of processing

1. You have given your consent to the processing

2. It is necessary to perform your engagement contract

3. It is necessary for us to comply with a legal obligation

4. It is necessary for our legitimate interests or those of third parties

5. It is necessary to protect your vital interests (or those of someone else)

6. It is necessary to perform a task in the public interest or in our official authority

Purposes of processing

1. You have given your consent to the processing

2. It is necessary to perform your engagement contract

3. It is necessary for us to comply with a legal obligation

4. It is necessary for our legitimate interests or those of third parties

5. It is necessary to protect your vital interests (or those of someone else)

6. It is necessary to perform a task in the public interest or in our official authority

Special category lawful basis

We are permitted to process your personal data because... 

Schedule 5 – Data Processors 

We use third party organisations (known as data processors) who carry out services on the University’s behalf under contract. We will ensure that only the minimum amount of relevant personal data necessary for the purpose is transferred. We will ensure that contractual terms are included to ensure compliance with data protection laws and that the data is used solely under our instruction. In these circumstances personal data will be deleted or returned to us after the contract has terminated. Where you complain about a third party provider who is providing services on behalf of the University your complaint will be shared with them (although we will obtain your permission before sharing confidential health information).  

 Some of our key service providers are listed below:   

*AI enabled 

Schedule 6 –Third Party Data Controllers 

We share your personal data with third party data controller(s) where we are required by law to do so or where those third party organisations have a legitimate reason to use your data for their own purposes. Our data protection policy requires that we ensure a Data Sharing Agreement is put in place to protect the use of your personal data. We will ensure that only the minimum information necessary to fulfil the purpose is shared. 

We are a signatory to the Kent and Medway Information Sharing Agreement and where possible we will use that data sharing agreement for sharing with other signatories. For more information please see the Kent and Medway Information Partnership. 

The organisations and circumstances where we most commonly share your personal data are listed below: