About us

Introduction

Under the Data Protection Act, personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. To prevent unauthorised or accidental disclosure of the information, it is essential to exercise care in its disposal, including protecting its security and confidentiality during storage, transportation, handling and destruction.

Faculties and directorates should establish procedures appropriate to the information held and processed by them, and ensure that all employees are aware of those procedures. In addition, a disposal record should be held to assist the University in responding to any enquiries made under the Data Protection Act.
Recommended Retention Periods

A checklist for recommended retention periods for various classes of data based on current legal requirements and good practice is attached. The list of the categories link to detailed tables outlining current records and retention guidelines.

Teaching & Research
1 Teaching (pdf format)
2 Research (pdf format)

Student Administration & Support
3 Student Administration (pdf format)
4 Student Support Services Management (pdf format)

Commercial Enterprise
5 Related Companies Management (pdf format)
6 Commercial Services Management (pdf format)
7 Retail Trading Management (pdf format)

External Relations
8 Public Relations Management (pdf format)
9 Media Relations Management (pdf format)
10 HE Sector Relations Management (pdf format)
11 Community Relations Management (pdf format)
12 Alumni Relations Management (pdf format)
13 Fundraising (pdf format)
14 Publishing (pdf format)

Corporate Management
15 Strategic Planning & Performance Management (pdf format)
16 Governance (pdf format)
17 Risk Management (pdf format)
18 Quality Management (pdf format)
19 Audit (pdf format)
20 Legal Affairs Management (pdf format)
21 Government Relations Management (pdf format)
22 HE Regulator Relations Management (pdf format)
23 Students’ Union Relations Management (pdf format)
24 Organisational Development (pdf format)
25 Health & Safety Management (pdf format)
26 Environmental Management (pdf format)

Resources Management
27 Estate Management (pdf format)
28 Finance Management (pdf format)
29 Human Resources Management (pdf format)
30 Information Resources Management (pdf format)
31 Intellectual Property Management (pdf format)
32 Information & Communications Technology (ICT) Systems Management (pdf format)
33 Equipment & Consumables Management (pdf format)
34 Insurance Management (pdf format)
35 Procurement (pdf format)
36 Internal Services Management (pdf format)

University records mean any data recorded in any form, including paper files, computer files, audio-and video tapes, film and microfiche, which are maintained by University employees, or agents, in the course of their employment.

Security of Records

Where possible there should be one set of archived records held securely under the purview of the responsible directorate named in the schedule. All other duplicate records should be disposed of as indicated below.

Disposal of Records

The destruction of University records must be authorised by the responsible Dean of Faculty or Head of Directorate.

When records are disposed of, either on-campus or off, it is important to use methods that do not allow future use or reconstruction.

Paper records containing personal information must be shredded or incinerated, not simply thrown out with other rubbish or put out for recycling. Disposal of large quantities of confidential waste can be contracted out but it is essential that the outside agency observe the same security standards as would be applied in-house.
Special care must be taken with electronic records, as these may be reconstructed from deleted information. Software tools are available which will remove all data from the medium so that it cannot be reconstructed and ICT may be consulted in this respect. Floppy disks should be physically destroyed.

Videotapes containing personal information should also be physically destroyed and not simply thrown away. Overwriting videotape that contains personal information with non-personal information will remove the previous images but this should be done on-campus by authorised employees.

A disposal record listing who has destroyed what records, when, and using what method of destruction should be kept. However, it must not, in itself, contain personal information but refer to the record type rather than the contents of the record.