Staff Privacy Notice

This privacy notice applies to all current employees (“you” and “your”) of the University of Warwick (“Warwick”, “UoW”, “us”, “we” and “our”) and explains how we collect, use, and protect your personal data in in accordance with the Data Protection Act 2018 and the UK GDPR (“data protection law”).

Please note that this notice is for informational purposes only and does not form part of your contract of employment or any other contract to provide services.

What personal data do we collect and use?

As part of our relationship with you, we may collect, store, and process a range of personal data. This includes, but is not limited to:

Full name, title, date of birth, gender, home address, personal phone numbers, and email addresses
Marital status, details of personal relationships, dependants, next of kin, and emergency contact information
National Insurance number, bank account details, payroll information, and tax status
Salary details, pension arrangements, benefits, and annual leave records
Compensation history, including merit-based pay and SPRR (Staff Performance and Review) payments
Salary benchmarking and pay modelling data
Copies of driving licences (where driving is a job requirement)
Employment history including job titles, working hours, training records, and professional memberships
Application materials such as CVs, cover letters, references, and documentation related to the right to work
Immigration status and related documentation
Records relating to performance, development, and progression (e.g., PDRs and training)
Disciplinary and grievance records, as well as information related to performance management
Details of maternity, paternity, shared parental, adoption leave, and other time off
CCTV footage and data collected from access systems (e.g., swipe/ID cards, photographs)
Information on your use of our IT and communication systems
Details necessary for research passports for NHS-related research
Information about your involvement in research projects, outputs, and relevant personal circumstances

We may also collect and use more sensitive personal data where necessary, including:

Ethnic origin, religious beliefs (for diversity, inclusion, and institutional reporting purposes)
Trade union membership
Health-related information, including medical conditions, disabilities, and sickness absence records
Criminal convictions and offences (where relevant to your role)

In some cases, you are legally or contractually required to provide specific personal data. Failure to provide this information may prevent us from being able to employ you, continue your employment, or meet our legal obligations.

How do we obtain your personal data?

The University of Warwick (UoW) collects personal data relating to employees, agency workers, volunteers, individuals on work experience, contractors, honorary position holders, and visiting personnel primarily during the application and recruitment process. This information may be provided directly by you or obtained from third parties, such as recruitment agencies or background screening providers.

We may also gather information from former employers and referees as part of our pre-employment checks.

Further personal data will be collected throughout the duration of your engagement with the University as part of your work-related activities.

How do we use your personal data and which legal bases do we rely on?

Purpose	Legal Basis
To make decisions regarding your recruitment, ongoing engagement, or termination of employment or association	To fulfil our contractual obligations and/or comply with legal requirements.
To confirm that you are legally entitled to work in the UK	Compliance with a legal obligation
To process your payment and make the necessary tax and National Insurance deductions, as required	Performance of a contract and/or compliance with a legal obligation.
To provide associated workplace benefits	Performance of a contract
To liaise with your pension provider and manage your pension, including spousal and dependent entitlements	Compliance with a legal obligation and/or performance of a contract.
To administer the contract the University has entered into with you	Performance of a contract
To administer the University’s staff policies, such as the Personal Relationships Policy and others. etc.	Performance of a contract
To provide education, including the delivery of lectures, seminars, and other learning activities (both in person and pre-recorded).	Performance of a contract and undertaking a task in the public interest
To facilitate research	Performance of a contract and undertaking a task in the public interest
Business management and planning, including accounting and auditing.	Compliance with a legal obligation and/or legitimate interest of sound management of the business of the University.
Conducting performance reviews, managing performance and determining performance requirements, including making decisions in relation to completion of probation.	Performance of a contract.
Gathering evidence for conducting investigations for possible grievance or disciplinary hearings.	Performance of a contract.
Education, training and development requirements (including online core training).	Compliance with a legal obligation and legitimate interest of ensuring staff have access to training and development where required.
Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.	Compliance with a legal obligation.
Ascertaining your fitness to work and managing sickness absence.	Compliance with a legal obligation and legitimate interest of ensuring the efficient running of the University.
To prevent fraud.	Compliance with a legal obligation.
To monitor your use of our information and communication systems to ensure compliance with the University’s IT policies and to investigate security incidents.	Legitimate interest of ensuring proper usage and network security of University IT systems and public task.
To enable the University to deal with requests (from you or others) under Freedom of Information and other transparency legislation or Data subject rights requests under the UK General Data Protection Regulation.This may include monitoring, searching, and reviewing University systems (including email accounts and shared drives) to identify and extract relevant information.	Compliance with a legal obligation.
To monitor equality, diversity and inclusion	Compliance with a legal obligation.
Issuing identity cards to staff.	Legitimate interest of maintaining security whilst allowing staff access to university areas.
Providing staff parking permits.	Performance of a contract.
Ensuring the safety and security of UoW, its people and facilities.	Compliance with a legal obligation.
Carrying out DBS checks.	Compliance with a legal obligation.
Monitoring your entry in to and movement within University buildings to ensure compliance with University regulations, policies/ procedures and relevant legislation – e.g. Health and Safety. Processing card access data to ensure the health, safety and wellbeing of persons present on campus, preventing crime and disorder and individual or group compliance with reasonable directions given by Campus Security, your department, University regulations and policies/procedures and the law. Sharing information internally, where appropriate, to identify individuals suspected of or failing to follow University regulations, policies/procedure regarding access to buildings. Issuing warnings and/or instigating (and progressing) disciplinary action and where appropriate sharing information with regulatory authorities such as the Police.	Compliance with a legal obligation (Health and Safety) Legitimate interest of maintaining safety and security of the University community and enabling the University and relevant regulatory authorities, including the Police, to consider and take further action including disciplinary action, where appropriate.
Time management	Legitimate interests
To provide IT services, building access, and library services.	Necessary for the performance of the employment contract.
To conduct surveillance via CCTV, including body-worn cameras, for the prevention, detection, and investigation of crime and other incidents; to ensure the safety of staff, students, and visitors; to assist in investigating suspected breaches of university regulations; and to monitor and enforce traffic-related matters.	The University has a legitimate interest in ensuring its campuses remain safe places to work, live, and study, and a statutory duty of care to provide a safe environment for its staff and students.
To monitor the use of car parking facilities, in accordance with the terms and conditions of the contract, which require surveillance for monitoring purposes.	Necessary for the performance of the contract.
To conduct internal research and analysis for non-academic purposes, including monitoring performance and quality at an institutional level, where there is no direct impact on data subjects	Legitimate Interest
To publish basic departmental contact details internally and externally on staff lookup tools and/or team websites.	Legitimate interest and performance of a contract.
To record the contents of calls and voice interactions when contacting helpdesk facilities, for training and monitoring purposes.	Legitimate interests
To safeguard vulnerable individuals (e.g. children and vulnerable adults)	Recognised Legitimate Interests
To protect public/national security and defence (e.g. measures to help prevent harm and support safety)	Recognised Legitimate Interests
Emergency response (e.g. where there is a need to act in relation to events or situations that pose a threat or risk to human welfare and/or the environment)	Recognised Legitimate Interests
To detect, investigate or prevent crime, or apprehend or prosecute offenders	Recognised Legitimate Interests
To assist public bodies and bodies carrying out public tasks	Recognised Legitimate Interests

In certain circumstances, the UoW may seek your written consent to process particularly sensitive data. If this occurs, UoW will provide you with comprehensive details regarding the information required and the reasons for its collection, allowing you to make an informed decision about whether or not to grant your consent.

Should you choose to provide consent for the collection, processing, and transfer of your personal data for a specific purpose, you retain the right to withdraw that consent at any time. To do so, simply contact us at infocompliance@warwick.ac.uk.

Once UoW is notified of your decision to withdraw consent, we will immediately cease processing your data for the purpose(s) you initially approved. However, if there is another lawful basis for continuing to process your data, we will notify you of this legitimate reason.

Which third parties may we share your personal data with and what legal bases do we rely on?

The UoW may share your personal data with third parties when required by law, when necessary to manage our working relationship with you, or when there is a legitimate interest in doing so. This includes, but is not limited to, sharing data for joint appointments with external organisations. The third parties with whom we may share your data include:

Third Parties	Legal Basis
The respective pension scheme applicable to your contract (USS, UWPS, NHS).	Compliance with a legal obligation and/or performance of a contract.
To submit staff data to Jisc (HESA) for higher education reporting, regulatory and statistical purposes.	Public Task
United Kingdom Visas and Immigration (UKVI) for visa applications.	Compliance with a legal obligation.
Disclosure and Barring Service (DBS) checking organisation (GB Group).	Compliance with a legal obligation and/or legitimate interest.
NHS.	Performance of a contract and/or consent.
HMRC.	Compliance with a legal obligation.
Car Parking Partnership.	Performance of a contract.
APCOA	Performance of a contract.
UKRI	Legitimate interests.
Higher Education Rankings	Legitimate interests of the University/necessary for the performance of contract
External professional accrediting bodies	Legitimate interests of the University/necessary for the performance of contract
Third party training organisations/facilitators engaged by the Learning and Development Centre	Consent and/or legitimate interest (for example, award of a qualification/ certification).
Contractors	Compliance with a legal obligation and/or performance of a contract.
Our professional advisors e.g. insurers, auditors, lawyers, etc.	Legitimate interests.
Third-party organisations that process personal data on our behalf, such as training providers, assessment providers, and employment surveyors, may have access to your data. The purpose of sharing this data is to facilitate the services they provide, such as training, assessment, or employment surveys.	Performance of a contract and/or legitimate interest.
Professional regulatory bodies where you are professionally registered	Performance of a contract and/or legitimate interest
IT Service Providers to maintain and support IT systems and infrastructure	Performance of a contract / Legitimate interest
Insurance Providers for processing insurance claims or coverage	Performance of a contract / Legitimate interest
Law enforcement agencies for the prevention or investigation of crimes	Legal obligation / Legitimate interest / Public task
TCS (Helpdesk Provider) to provide IT support and manage helpdesk services	Performance of a contract / Legitimate interest
Genesys	Performance of a contract / Legitimate interest
Emergency services	Recognised Legitimate Interests
Law enforcement bodies/agencies	Recognised Legitimate Interests
Local authorities	Recognised Legitimate Interests
Healthcare providers	Recognised Legitimate Interests
Environmental protection and regulatory bodies	Recognised Legitimate Interests
Specialist safeguarding, welfare, security, or crisis management service providers	Recognised Legitimate Interests
Government departments, public bodies and other bodies carrying out legally authorised public tasks.	Recognised Legitimate Interests

We will only share your personal data with third parties where there is a lawful basis for doing so and appropriate safeguards are in place. We will never sell your personal data or share it with third parties for their own marketing purposes. Please note that, where we rely on your consent, you have the right to withdraw your consent at any time. If we need to transfer your personal data outside the UK, we will ensure that appropriate safeguards are put in place where required by data protection law. Further details of these safeguards can be provided upon request to Legal and Compliance Services.

How long do we keep your personal data?

The University retains personal data in accordance with its Records Retention Schedule.

Personal data will be kept only for as long as necessary for the purposes for which it was collected, including meeting legal, regulatory, accounting or reporting requirements.

Further information on retention periods can be found in the University Records Retention Schedule.

What rights do I have in relation to my personal data?

Data protection law gives you specific rights over your personal data, as follows:

the right to access personal data held about you;
the right to be informed about how and why your data is used;
the right to have your data rectified, erased or restricted;
the right to object to the processing of your data;
the right to portability of your data; and
the right not to be subject to a decision based solely on automated processing.

If you have concerns about how we use your personal data, you have the right to make a data protection complaint directly to us.

If you would like to make a data protection complaint directly to us, please complete and submit the form below providing as much information as possible:

https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/complaints/complaintform/

Once we have received your complaint, we will:

acknowledge receipt of your complaint;
review the matters raised and make appropriate enquiries; and
keep you informed (where appropriate) and, without undue delay, report the outcome of your complaint to you.

If you are dissatisfied with the University’s response to your complaint, you have the right to escalate your complaint to the Information Commission's Office (the ICO). You can contact the ICO at www.ico.org.uk.

How can you obtain more information about this privacy notice?

If you have any questions about this privacy notice, please do not hesitate to contact our Data Protection team and/or Data Protection Officer at: infocompliance@warwick.ac.uk.

This privacy notice was last updated on 5 October 2026. We reserve the right to update or modify this notice at any time to reflect changes in legal requirements, operational needs, or best practices. Any significant changes will be communicated to relevant individuals through appropriate channels (e.g. on our website). The most recent version of the notice will always be available for your reference.