Privacy notice for research

This privacy notice relates to individuals participating in research projects led by the University of Bedfordshire. It explains how the University of Bedfordshire will use your personal information and your rights under data protection legislation. It is important that you read this notice prior to providing your information.

Please note that this standard information should be considered alongside information provided by the researcher for each project, which is usually in the form of a Participant Information Sheet (PIS).

The PIS will include further details about how personal information is processed in the particular project, including: what data is being processed; how it is being stored; how long it will be retained for, and any other recipients of the personal information. It is usually given to participants before they decide whether or not they want to participate in the research.

The University of Bedfordshire is the data controller under data protection legislation. This means that the University is responsible for how your personal data is used and for responding to any requests from you in relation to your personal data.

Any enquiries regarding data protection should be made to the University’s Data Protection Officer at DPO@beds.ac.uk

If you are participating in a research project, we may collect your personal information. The type of information that we collect will vary depending on the project. Our basis for collecting this information is outlined below:

Type of information	Basis for processing
Personal information and associated research data collected for the purposes of conducting research.	It is necessary for the performance of a task carried out in the public interest.
Certain types of personal information such as information about an individual’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life, or sexual orientation are defined as ‘Special Category’ data under the legislation.	It is necessary for the performance of a task carried out in the public interest and It is necessary for scientific or historical research purposes in accordance with the relevant legislation (Data Protection Act 2018, Schedule 1, Part 1, Para 4).
Criminal conviction / offence data	It is necessary for the performance of a task carried out in the public interest and is processed in accordance with Article 10 of the General Data Protection Regulation and the Data Protection Act 2018, Schedule 1, Part 1, Para 4.

For some projects, personal information may be transferred outside the UK. This will normally only be done when research is taking place in locations outside the UK. If this happens, the University will ensure that appropriate safeguards are in place. You will be fully informed about any transferring of data outside the UK and associated safeguards, usually in the Participant Information Sheet.

If data will be shared with other individuals or organisations, you will be advised of this in the PIS.

If you participate in a research project, you may be asked to sign a participant consent form. Consent forms will typically be retained by the University for at least as long as the identifiable research data are retained. In most cases they will be retained for longer, the exact time frame will be determined by the need for access to this information in the unfortunate case of an unanticipated problem or a complaint. 5 years after the research is completed will be suitable for many projects, but beyond 20 years will be considered for any longitudinal or ‘high risk’ studies involving children, adults without capacity or a contentious research outcome.

You have the right to:

be informed about the collection and use of your personal data;
request access to the personal data we hold about you;
request to have personal data rectified if it is inaccurate or incomplete;
object to your data being processed;
request to restrict the processing of your personal information;
and rights related to automated decision-making and profiling.

To exercise these rights please contact DPO@beds.ac.uk. Please note, many of these rights do not apply when the data is being used for research purposes. However, we will always try to comply where it does not prevent or seriously impair the achievement of the research purpose.

If you have any concerns/issues with the way the University has processed your personal data, you can contact the Data Protection Officer at DPO@beds.ac.uk. You also have the right to lodge a complaint against the University regarding data protection issues with the Information Commissioner’s Office