Information compliance
The University’s Information Compliance framework sets out how the University manages, protects, and uses information to ensure legal compliance, mitigate risks, support operational efficiency, and uphold data protection and security standards.
On this page
What is Information Compliance?
The University is a complex organisation holding a very large amount of information across all of its functions and operations. Much of this is personal data, or other confidential information, regarding which there are specific requirements and risks. Information Compliance covers everything that an organisation may do with the information it handles, including adherence to legal and compliance requirements such as:
It also ensures that the University utilises its information assets in the most effective way and maximises value from those assets.
Why is it important ?
It is vital that the University is able to obtain, use, manage, disclose and dispose of the information it needs, as appropriate, in a responsible and secure manner that adheres to both operational requirements and the responsibilities imposed by legislation and regulation.
Key documents
A suite of policies and guidance documents are in place to address the University's Information Compliance requirements:
-
ICP-01 Information compliance policy - This policy outlines how the University manages, protects, and uses information to ensure legal compliance, mitigate risks, support operational efficiency, and uphold data protection and security standards.
-
ICP-02 Data protection policy - This policy sets out how the University processes the personal data that it holds (relating to students, staff, research participants and third parties). It outlines the University’s responsibilities under data protection legislation and regulation, setting out how it will comply, and provides instruction for staff handling personal data.
-
ICP-03 Records management policy - This policy sets out the principles and practical considerations for the consistent management of records throughout their life cycle, from creation or receipt through to their operational use, storage and disposal.
- CCTV code of practice - Details of the purpose and operation of the University's CCTV system.
-
Personal Data Breach Procedure - Sets out procedures for the identification, investigation, mitigation, notification and review of personal data breaches by the University. The document is not freely accessible to all, but can be made available on request. A Personal Data Breach Report Form (IGP-07) (Office document, 60kB) will be used to record data breaches and outcomes after they have been investigated. For more information please refer to our Data breaches and incidents page.
- Data Protection Impact Assessment (DPIA) Procedure - This procedure sets out the University’s approach towards identifying the need for, undertaking and implementing Data Protection Impact Assessments (DPIAs) to ensure that the rights and freedoms of individuals are protected in compliance with the UK General Protection Regulation (UK GDPR) and Data Protection Act 2018.
-
Records retention schedule (PDF, 2,583kB) - Provides guidance for all staff and areas of the University on recommended retention periods for different categories of records, accounting for legislative and regulatory requirements, best practice standards, existing policies and practices, and operational needs.
-
Information Classification Scheme (PDF, 99kB) - Sets out the five confidentiality classifications that apply to all University information, including personal data, and will help determine how the information should be handled relevant to the associated risk.
Who is responsible?
The policies and procedures above form a central part of the University's Information Compliance Framework, they are complemented by a structure incorporating roles and responsibilities. This is headed by the Senior Information Risk Owners (SIRO, as below) to ensure that there is ownership and awareness of information risks and issues at a senior level:
- University Secretary and Director of Governance (Accountable)
- Chief Digital Information Officer (Responsible)
The Information Compliance Team in the University Secretary's Office, led by the Information Compliance Manager, is tasked with ensuring that appropriate policies, procedures, practices, guidance and advice are in place and available so that staff and students use the information they need in a way that meets requirements.
Information asset owners are in place within schools, faculties and divisions to ensure information is owned and managed appropriately at a local level.
The Information Governance and Security Advisory Board has membership from across the University and discusses and advises on all matters relating to the handling of information.
Information Asset Register
The University’s Information Asset Register (IAR) is a record of all information assets held by Professional Services divisions, or by academic Schools and Faculties. The IAR helps us ensure that the University complies with the requirements of the UK General Data Protection Regulation (GDPR), and that information is managed consistently across the organisation.
Research data
The Research Data Service can offer advice and assistance to those managing research data and the Research Data Storage Facility offers a secure storage option to all University staff. The University also has an Open access policy in relation to research publications. Guidance for staff and PGRs on what researchers need to do to comply with the UK General Data Protection Regulation (UK GDPR) when carrying out research involving personal data is available internally.
For information how research data is used by the University please refer to our privacy notices.