Research Privacy Notice

Please note that this notice is for informational purposes only and does not form part of any contract.

What personal data do we collect and use?

As part of our research activities, we may collect, store, and process a range of personal data. The type of personal information collected and used will depend on the research objectives of the specific project. This information is usually set out in the Participant Information Leaflet provided to you before taking part in the study.

This may include, but is not limited to:

Personal identifiers and contact details:

• Name, date of birth, contact information
• Demographic details such as gender, nationality, occupation or education

Research participation data:

• Responses to questionnaires or interviews
• Audio or video recordings
• Biographical information or history relevant to the study
• Behavioural or observational data
• Digital interaction or device-related data (where relevant)

Administrative data:

• Participant IDs or pseudonymised codes
• Consent records and withdrawal requests
• Correspondence with the research team

We may also collect and use more sensitive personal data where necessary for the purposes of research. This includes:

Special category personal data:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Health data
• Genetic or biometric data
• Data concerning sex life or sexual orientation

We will only collect special category data where it is necessary for the research and the appropriate lawful basis and safeguards are in place.

Where research data is anonymised, it will no longer constitute personal data. Once data is fully anonymised, it will not be possible to withdraw it.

How do we obtain your personal data?

We obtain personal data in several ways, depending on the research project.

Directly from you:

• When you participate in interviews, surveys, focus groups or trials
• Through forms, recordings or questionnaires
• Through observation or interaction with research technologies or tools

From third parties:

• Data shared by research partners (e.g. NHS or public bodies)
• Existing data collected by government departments or agencies (e.g. Department for Education)
• Publicly available sources

In some cases, the University may act as a data processor on behalf of another organisation, while in others it may be the data controller or joint controller. This will be made clear in the Participant Information Leaflet.

How do we use your personal data and which legal bases do we rely on?

Purpose	Legal Basis
To carry out academic research	Task carried out in the public interest
To process special category personal data for research purposes	Archiving, scientific, historical or statistical research in the public interest
To contact you regarding your participation in a research project	Task carried out in the public interest or your consent
To manage consent, withdrawals and data subject rights	Compliance with a legal obligation
To collaborate with external research partners or funders	Task in the public interest or performance of a contract
To publish or share research outcomes	Task in the public interest/ Legitimate interest
To use your data in future research studies (where permitted)	Consent or task in the public interest (as approved by ethics committees)
To safeguard vulnerable individuals (e.g. children and vulnerable adults)	Recognised Legitimate Interests
To protect public/national security and defence (e.g. measures to help prevent harm and support safety)	Recognised Legitimate Interests
Emergency response (e.g. where there is a need to act in relation to events or situations that pose a threat or risk to human welfare and/or the environment)	Recognised Legitimate Interests
To detect, investigate or prevent crime, or apprehend or prosecute offenders	Recognised Legitimate Interests
Toassistpublic bodies and bodies carrying out public tasks	Recognised Legitimate Interests

Additional regulatory requirements for health-related research

Where research involves NHS patient information or other confidential health data, the University will also comply with the common law duty of confidentiality. This means that, where required, we will obtain patient consent or rely on appropriate legal support, such as approvals under Section 251 of the NHS Act 2006, before using such information for research purposes.

In certain circumstances, the UoW may seek your written consent to process particularly sensitive data. If this occurs, UoW will provide you with comprehensive details regarding the information required and the reasons for its collection, allowing you to make an informed decision about whether or not to grant your consent.

Should you choose to provide consent for the collection, processing, and transfer of your personal data for a specific purpose, you retain the right to withdraw that consent at any time. To do so, simply contact us at infocompliance@warwick.ac.uk

Once UoW is notified of your decision to withdraw consent, we will immediately cease processing your data for the purpose(s) you initially approved. However, if there is another lawful basis for continuing to process your data, we will notify you of this legitimate reason.

Which third parties may we share your personal data with and what legal bases do we rely on?

The UoW may share personal data with third parties involved in the research process where it is necessary to achieve the research outcomes, subject to appropriate safeguards.

Third Parties	Legal Basis
External research collaborators and partners (e.g. universities, NHS, charities)	Task in the public interest/ Legitimate interest/Consent
Research funders (e.g. UKRI, Research Councils)	Task in the public interest
Service providers that support research (e.g. survey tools, data storage platforms such as Files.Warwick)	Task in the public interest/ Performance of a contract
Ethics committees or regulatory authorities	Compliance with a legal obligation
Professional advisors (e.g. Legal & Compliance Services)	Legitimate interest
Emergency services	Recognised Legitimate Interests
Law enforcement bodies/agencies	Recognised Legitimate Interests
Local authorities	Recognised Legitimate Interests
Healthcare providers	Recognised Legitimate Interests
Environmental protection and regulatory bodies	Recognised Legitimate Interests
Specialist safeguarding, welfare, security, or crisis management service providers	Recognised Legitimate Interests
Government departments, public bodies and other bodies carrying out legally authorised public tasks.	Recognised Legitimate Interests

We will only share your personal data with third parties where there is a lawful basis for doing so and appropriate safeguards are in place. We will never sell your personal data or share it with third parties for their own marketing purposes. Please note that, where we rely on your consent, you have the right to withdraw your consent at any time. If we need to transfer your personal data outside the UK, we will ensure that appropriate safeguards are put in place where required by data protection law. Further details of these safeguards can be provided upon request to Legal and Compliance Services.

In some cases, personal data shared for research will be anonymised or pseudonymised. Where personal data cannot be anonymised, we may ask for your explicit consent to share it.

What rights do I have in relation to my personal data?

Data protection law gives you specific rights over your personal data, as follows:

• the right to access personal data held about you;
• the right to be informed about how and why your data is used;
• the right to have your data rectified, erased or restricted;
• the right to object to the processing of your data;
• the right to portability of your data; and
• the right not to be subject to a decision based solely on automated processing.

Please note that, in certain circumstances, some of these rights may be limited or may not apply where an exemption under data protection law applies to research activities. Where such an exemption applies, this will be explained in the information provided to you about the specific research project, where appropriate.

If you have concerns about how we use your personal data, you have the right to make a data protection complaint directly to us.

If you would like to make a data protection complaint directly to us, please complete and submit the form below providing as much information as possible:

https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/complaints/complaintform/

Once we have received your complaint, we will:

• acknowledge receipt of your complaint;
• review the matters raised and make appropriate enquiries; and
• keep you informed (where appropriate) and, without undue delay, report the outcome of your complaint to you.

If you are dissatisfied with the University’s response to your complaint, you have the right to escalate your complaint to the Information Commission's Office (the ICO). You can contact the ICO at www.ico.org.uk.

How can you obtain more information about this privacy notice?

If you have any questions about this privacy notice, please do not hesitate to contact our Data Protection team and/or Data Protection Officer at: infocompliance@warwick.ac.uk.

This privacy notice was last updated on 5 October 2026. We reserve the right to update or modify this notice at any time to reflect changes in legal requirements, operational needs, or best practices. Any significant changes will be communicated to relevant individuals through appropriate channels (e.g. on our website). The most recent version of the notice will always be available for your reference.