Skip to main content

Research Participant Privacy Notice

Purpose of this notice
Why do we process personal data?
How do we follow data protection principles?
What do we do with personal data?
Your rights as a data subject
Data security
Retention periods
Additional notices and guidance/policies
Concerns and contact details

Purpose of this notice

This Notice explains how and why the University uses personal data for research; what individual rights are afforded under the Data Protection Act 2018 (DPA) and who to contact with any queries or concerns.
All research projects are different. This information is intended to supplement the specific information you will have been provided with when asked to participate in one of our research projects. The project specific information will provide details on how and why we will process your personal data, who will have access to it, any automated decision-making that affects you and for how long we will retain your personal data.

Why do we process personal data?

As a publically funded organisation we undertake scientific research which is in the public interest. This includes processing personal data to develop new data analysis techniques and tools, and investigate factors that affect the treatment and trajectories of different diseases. The categories of personal data included are names, addresses, date of birth, mental and physical health data, ethnic origin and sex life, and this is usually analysed at the level of data pertaining to an individual. The types of organisations we receive data from include health related organisations such as the NHS, data held by government departments (with appropriate permission), private organisations and charitable organisations. The recipients of this personal data are researchers. The DPA requires us to have a legal basis for this processing; we rely upon “the performance of a task carried out in the public interest” as our lawful basis for processing personal data, and on “archiving in the public interest, scientific or historical research purposes, or statistical purposes” as our additional lawful basis for processing special category personal data (that which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, and data concerning health, sex life or sexual orientation).

How do we follow data protection principles?

  •  We have lawful bases for processing personal and special category data.
  • Data are used fairly and transparently; we will make it clear to individuals what their data will be used for, how it will be handled and what their rights are.
  • We only collect and use personal data for our research, for research in the public interest, or to support the work of our organisation.
  • We only collect the minimum amount of personal data which we need for our purposes.
  • We take steps to ensure that the personal data we hold is accurate.
  • We keep your personal data in an identifiable format for the minimum time required.
  • We take steps to ensure that your data is held securely.
  •  We keep a record of our processing activities.

What do we do with personal data?

Research data can be a very valuable resource for improving public services and our understanding of the societies we live in. One way we can get the most benefit from this work is to make the data available, usually when the research has finished, to other researchers. Sometimes these researchers will be based outside the European Union. We will only ever share research data with organisations that can guarantee to store it securely. We will never sell your personal data, and any data shared cannot be used to contact individuals.

We do not conduct automated decision making with the data.

The project specific information will include more detail about how your data will be used.

Your rights as a data subject

Because we use personal data to support scientific research on the public interest, individuals participating in research do not have the same rights regarding their personal data as they would in other situations. This means that the following rights are limited for individuals who participate, or have participated in, a research project:

  • The right to access the data we hold about you.
  • The right to rectify the data we hold about you.
  • The right to have the data we hold about you erased.
  • The right to restrict how we process your data.
  • The right to data portability.
  • The right to object to us processing the data we hold about you.

We have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Retention periods

We will only retain your identifiable personal information for as long as necessary to fulfil the purposes we collected it for; we may then retain your data in anonymised or pseudonymised format.

To determine the appropriate retention period for personal data we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Additional notices and guidance/policies

The University has also published separate policies and guidance which may be applicable to you in addition to other privacy notices:

Staff Privacy Notice
Student Privacy Notice
The Research and Innovation Service website has other relevant policies and guidance.

Communication

In the first instance please contact the researcher who your initial contact was with. You may also contact the Data Protection Officer for further information (see contact details below). Please see the Information Commissioner's Office Website for further information on the law. You have a right to complain to the Information Commissioner’s Office (ICO) about the way in which we process your personal data. Please see the Information Commissioner's Office Website or contact 0303 123 1113.

Concerns and contact details

If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice, please contact our Data Protection Officer, Rebecca Messenger-Clark dpo@leeds.ac.uk

Our general postal address is University of Leeds, Leeds LS2 9JT, UK.

Our data controller registration number provided by the Information Commissioner's Office is Z553814X.
This notice was last updated on 10th October 2023.