Data protection and information rights

If you are applying to work or study at the University we are required to process your personal information and we are committed to doing so in accordance with the current data protection legislation.

We may be required to process ’special category data’ which includes disability requirements and medical conditions. Extra measures are required when this category of data is captured.

We have individual privacy notices for the following groups because there are differences in the way we process each group’s data:

• Undergraduate applicant privacy policy
• Undergraduate outreach privacy policy
• Postgraduate applicant privacy policy
• Job applicant privacy policy
• Department for Continuing Education (Undergraduate Courses) applicant privacy policy

The privacy policies in this section are relevant to current and former: students, employees, workers, as well as secondees from other organisations, volunteers and interns. If any of these apply to you we encourage you to familiarise yourself with the relevant privacy policies. The policies explain how we obtain, use, share and protect your data.

• Student privacy policy
• Staff privacy policy 

To understand how we use alumni and donors data read the University’s Alumni, Donors and Supporters Privacy Notice.

• Alumni, Donors and Supporters Privacy Notice

The UK's data protection legislation requires the University to have a website privacy policy. The policy provides details on how we collect and use your personal data while you use any ox.ac.uk websites. Some University areas may use their own website privacy policy as they may have different requirements.

This website privacy policy explains: The types of data we collect, how we use it, where we store data, as well as information about your rights.

• Website privacy policy

All research participants will receive information from the research study or project run by researchers at the University on how their personal data will be used. You should contact the research team directly if you want to discuss the specifics of your study or project in more detail. Because of the huge variety of research being carried out at the University each participant information sheet is likely to be specific to your project.

For more information please click the link below:

• How we use your personal information for research purposes

• Oxford University Security Services (including CCTV) Privacy Notice

Data retention refers to the length of time data will be actively retained by the University before it is destroyed, archived or anonymised.  

The University’s data retention schedules set out the period of time that categories of data held by the University will normally be kept. Presenting retention periods in a schedule format and on the basis of applicable legal or regulatory requirements, recognised good practice or internal policy, provides a systematic, accountable and transparent approach to data management and compliance.  

Importantly, in terms of the personal data we hold, our data retention schedules support the University to monitor and maintain compliance with the storage limitation principle under the UK General Data Protection Regulation (UK GDPR). The storage limitation principle states that we must not keep data longer than necessary for the purposes for which it was collected.

Below are links to further information about the retention of certain types of data:

The ‘Guidelines on the retention of student data and records’ provides sets out retention periods relating to student records and student administration data.  It is relevant to those responsible for managing student records and student administration data. 

View the policy document here:

• Student Record Retention Policy
• Appendix 1 - Student Record Retention Policy Changes

The ‘Retention periods for University personnel records’ sets out the records retention periods relating to personnel data that departments and divisions are asked by Personnel Services to follow.  

For further information visit the University's Personnel website. 

The ‘Retention of financial documents: Guidance for departments’ sets out the data retention requirements for financial documents. And it has the same status as the Financial Regulations.

View the guidance document here:

• Retention of Financial Documents

Anyone not satisfied with the response to their information request may ask the University to carry out an internal review of its response by contacting [email protected] or by writing to the following address:

Head of Information Compliance

              University Offices
              University of Oxford
              Wellington Square
              Oxford
              OX1 2JD

In submitting your request for a review, please provide either a case reference for the response referred to or details of when and to whom the original request was made.

The target for a substantive response to a request for a review is twenty working days. We will aim to keep complainants informed if any delays appear likely.

If you are dissatisfied with the way the University has used your personal data or handled your data protection request, you also have the right to submit a complaint to the Information Compliance Team or ask us to review our response. To raise a compliant, please write to the Information Compliance Team at [email protected]. If your complaint relates to a request you have submitted, please provide the case reference. Otherwise, please provide us with as much detail regarding your concerns as possible, including your relationship to the University.

We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of the legislation. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

You also have the right to complain to the Information Commissioner’s Office.

For advice and guidance, or to raise any concerns about data protection, please contact:

[email protected]

Email: [email protected]

For more information on breaches visit Reporting data breaches.

Before making an FOI request you may wish to consult our publication scheme to find out if the information you require has already been published or if there are plans to publish it. For advice and guidance, freedom of information requests and queries on information included within the University’s publication scheme, please contact:

[email protected]