Data Protection Policy

DP001

Document Control

Policy:: Data Protection
Policy ID:: DP001
Author:: Cassie O’Boyle, Head of Membership & Data Protection Officer
Approved by:: Union of Students Trustee Board
Approval Date:: 29th June 2026
Review Schedule:: Annually

Introduction

The Union will process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations (PECR).

The Union of Students is committed to protecting the privacy, confidentiality and rights of individuals whose personal data it processes.

The Union recognises that the lawful and responsible handling of personal data is fundamental to maintaining the trust and confidence of its members, elected officers, staff, volunteers, trustees, service users, suppliers, partners and other stakeholders.

The Union expects all individuals acting on its behalf to uphold the principles and requirements set out within this Policy.

Failure to comply with this Policy may expose the Union and affected individuals to legal, financial, operational and reputational risks and may result in disciplinary action.

Purpose

The purpose of this Policy is to:

establish the Union's commitment to compliance with UK data protection legislation;
define the principles governing the collection, use, storage, sharing and disposal of personal data;
outline the responsibilities of individuals who process personal data on behalf of the Union;
safeguard the rights and freedoms of individuals whose personal data is processed by the Union; and
provide a framework for accountability and good governance in relation to data protection.

Scope

This Policy applies to all personal data processed by, or on behalf of, the Union of Students.

It applies to:

Employees;
Elected Officers;
Trustees;
Student Representatives;
Community Leaders;
Volunteers;
Contractors and Consultants;
Agency Workers;
Third Parties processing personal data on behalf of the Union.

This Policy applies irrespective of the format in which information is held, including electronic systems, cloud-based services, paper records, audio recordings, video recordings, photographs and verbal communications.

The Policy applies to personal data relating to members, students, staff, volunteers, trustees, customers, suppliers, event attendees, advice service users and any other individuals whose information is processed by the Union.

Definitions

Personal Data: Any information relating to an identified or identifiable living individual. This includes information that can directly or indirectly identify a person, such as a name, address, email address, identification number, or online identifier.
Special Category Data: A more sensitive type of personal data that requires additional protection. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning a person's sex life or sexual orientation.
Data Controller: The person, organisation, or public authority that determines why and how personal data is processed. The controller is responsible for ensuring compliance with data protection laws.
Data Subject: The living individual whose personal data is being collected, held, or processed.
Data Processor: A person, organisation, or public authority that processes personal data on behalf of a data controller and according to the controller's instructions.
Processing: Any operation or set of operations performed on personal data, whether automated or manual. This includes collecting, recording, organising, storing, using, sharing, altering, retrieving, or deleting personal data.
Lawful basis: The legal reason that permits an organisation to process personal data under data protection law. Under GDPR, the six lawful bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests.

Principles of Data Protection

The Union shall ensure that all personal data is processed in accordance with the following principles.

Lawfulness, Fairness and Transparency

Personal data shall be processed lawfully, fairly and in a transparent manner. The Union shall identify and document an appropriate lawful basis for processing and shall provide clear privacy information to individuals regarding how their personal data will be used.

Purpose Limitation

Personal data shall be collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes.

Data Minimisation

Personal data collected and processed shall be adequate, relevant and limited to what is necessary for the purposes for which it is processed.

Accuracy

Reasonable steps shall be taken to ensure that personal data is accurate and, where necessary, kept up to date. Inaccurate personal data shall be rectified or erased without undue delay.

Storage Limitation

Personal data shall not be retained for longer than is necessary. The Union shall maintain retention and disposal arrangements to ensure that information is securely managed throughout its lifecycle.

Integrity and Confidentiality

Personal data shall be protected through appropriate technical and organisational measures designed to prevent unauthorised or unlawful processing, accidental loss, destruction or damage.

Accountability

The Union shall be responsible for, and able to demonstrate, compliance with applicable data protection legislation and this Policy.

Individual Rights

The Union shall respect and facilitate the rights afforded to individuals under UK data protection legislation.

These rights include:

The right to be informed;
The right of access to personal data;
The right to rectification;
The right to erasure where applicable;
The right to restrict processing;
The right to data portability where applicable;
The right to object to processing;
Rights relating to automated decision-making and profiling.

The Union shall maintain procedures to ensure that requests relating to individual rights are handled appropriately and within statutory timescales.

Individuals also have the right to lodge a complaint with the Information Commissioner's Office where they believe that their personal data has been processed unlawfully.

Privacy Notices

The Union shall ensure that appropriate privacy notices are provided wherever personal data is collected.

Privacy notices shall explain, in a clear and accessible manner:

What personal data is collected;
Why the data is required;
The lawful basis for processing;
Any recipients of the data;
Retention arrangements;
Individual rights; and
How to raise concerns or complaints.

No personal data shall be processed unless an appropriate lawful basis has been identified.

Data Protection by Design and Default

The Union is committed to embedding data protection considerations into its activities, services, projects, systems and decision-making processes.

Data protection by design and default shall be applied to all new initiatives involving personal data.

Where required, Data Protection Impact Assessments (DPIAs) shall be undertaken to identify and mitigate risks to individuals before processing commences.

Information Security

The Union shall implement and maintain appropriate technical and organisational measures to safeguard personal data.

Such measures may include:

Access controls;
Password and authentication controls;
Encryption where appropriate;
Secure storage arrangements;
Secure disposal processes;
System monitoring and auditing;
Staff training and awareness programmes.

Individuals who access personal data are responsible for ensuring that information is handled securely and only for authorised purposes.

Personal Data Breaches

Any actual, suspected or potential personal data breach must be reported immediately in accordance with the Union's Data Breach Procedure.

The Union shall investigate all reported breaches and take appropriate remedial action.

Where required by law, the Union shall notify the Information Commissioner's Office and affected individuals within the applicable statutory timescales.

Training & Awareness

The Union shall ensure that all relevant individuals receive appropriate data protection training and guidance.

The Union will also ensure appropriate resource and support is available to the Data Protection Officer to enable them to fulfil their duties.

Roles and Responsibilities

Board of Trustees

The Board of Trustees has overall responsibility for ensuring that appropriate governance arrangements are in place to support compliance with data protection legislation.

Chief Executive Officer

The Chief Executive Officer is accountable for ensuring that adequate resources, systems and controls are in place to support compliance with this Policy.

Data Protection Officer

The Data Protection Officer shall provide independent advice and guidance on data protection matters, monitor compliance, support risk management activities and act as the primary contact for regulatory authorities.

Managers

Managers are responsible for ensuring that personal data within their areas of responsibility is processed in accordance with this Policy and associated procedures.

Staff, Officers, Trustees & Volunteers

All individuals acting on behalf of the Union are responsible for:

Complying with this Policy;
Completing required training;
Protecting personal data;
Reporting data protection concerns and incidents promptly; and
Cooperating with compliance and audit activities.

Monitoring and Compliance

The Union shall monitor compliance with this Policy through audits, reviews, investigations, reporting arrangements and other assurance activities.

Failure to comply with this Policy may result in disciplinary action, termination of contractual arrangements, withdrawal of access privileges and, where appropriate, referral to relevant authorities.