Privacy Policy

UKRI understands the importance of protecting personal information and we are committed to complying with UK data protection legislation, including the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

We are committed to fostering a culture of transparency and accountability by demonstrating compliance with the principles set out in the legislation as laid out in our data protection policy (PDF, 190KB).

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you. It applies across UKRI, to our councils, Innovate UK and Research England and to our research centres, units and institutes.

On some of our websites this notice is supplemented with additional privacy policies or transparency information.

Our Partners

We work with third parties who provide services and with partners across the research and innovation system.

Where we use third parties as data processors to deliver, services agreements are in place which address how personal data is managed. Examples of third party data processors include UK Shared Business Services Limited (UK SBS), who provide our:

• HR and payroll
• finance
• procurement
• IT services.

Partners across the research and innovation system include:

• other research funding bodies, in the UK and internationally
• higher education institutions and institutes
• innovative businesses
• investors
• not-for-profit organisations
• policy makers.

We may share personal information with partners and third parties for the reasons identified later in this privacy notice.

Personal information may also be disclosed to third parties in order to:

• comply with any legal obligation
• enforce or apply our terms of use and other agreements
• protect the rights, property, or safety of UKRI or others.

What personal data we process and why

When we ask you for personal data, we will:

• tell you why we need it
• only ask for relevant information
• look after it and make sure it is only accessible to those who need to see it
• only keep it for as long there is a business, statutory or legal obligation (see our retention policy below)
• not to make your personal information available for commercial use without your permission.

In return, we ask you to:

• give us accurate information
• tell us as soon as possible if there are any changes.

The types of personal data processed and the lawful basis for processing depends upon the relationship you have with us. In the sections that follow we have outlined the purposes for which we process personal information and the type of personal information for our different relationships.

When we carry out processing in pursuit of our purposes laid out in Article 93 of the Higher Education and Research Act 2017, in the most part, our lawful basis for processing your personal information falls under ‘public task’.

The processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We also make use of contractual, legitimate and consent based processing.

Other lawful bases likely to be used include:

• performance of a contract
• legitimate interests
• legal obligation.

Users of the UKRI and council websites

We may collect and process personal information using public task, legitimate interest, performance of a contract, or consent as the lawful basis:

• information that you provide by filling in forms or surveys
• information in correspondence that you send us
• information you provide in accessing products or services, including payment, contact and delivery information
• details of your visits to our websites including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access.

We may use personal data we collect to:

• ensure that content from our website is presented in the most effective way for you
• provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes
• provide you with a means to access or purchase products and services
• allow you to participate in interactive features of our services, when you choose to do so
• notify you about changes to our websites or services.

We do not generally provide any personal information about users of our website to third parties or other users. Personal information may be shared with partners and other third parties to provide services or if we are under a duty to disclose or share information as discussed above.

Suppliers

We collect and process personal information for the following reasons using contractual and legitimate interest as a lawful basis:

• service provision and management
• site management (building access, car parking)
• health and safety
• dietary and accessibility requirements
• equality reporting.

Members of our research and innovation communities

We may collect and process personal information for the following reasons, using public task and legitimate interests as a lawful basis, to:

• manage funding applications and awards
• alert you to funding opportunities
• operate the peer review process
• undertake portfolio analysis and support the evaluation of our strategy and policy to investigate the effectiveness of our programmes (this may include evaluations of equality, diversity and inclusion)
• undertake research outcomes collection, monitoring and evaluation
• ensure our terms and conditions of funding are met, including audit and assurance processes, research integrity (including research misconduct allegations and investigations) and fraud prevention and detection
• operate our complaints policy (research conduct)
• manage access to research services, data and facilities
• facilitate commercialisation and technology transfer
• support your participation at UKRI meetings and workshops (this may include information on dietary or accessibility requirements)
• facilitate the nomination and award process for honours, awards and prizes provided by UKRI or third parties
• support your participation in competitions, awards and prize giving ceremonies hosted by UKRI (this may include information on dietary or accessibility requirements).

We may share personal information with third parties for the reasons identified above and earlier in this Privacy Notice.

For example, personal information may be disclosed to anti-fraud organisations in order to prevent and detect fraud. In another example personal information on accessibility or dietary requirements might be shared to support participation in events.

Further information on how personal information is used by UKRI can be found in the Grant Proposal and Training Grant Information (addendum to UKRI’s Grant and Training Grant Terms and Conditions), the relevant call or programme guidance documents and our web pages describing how we make decisions.

Members of the UKRI board, our council or peer review boards, panels and committees

We may collect and process personal information to manage our governance and funding processes for our public task purposes.

Peer reviewers

We collect and process personal information so you can participate as a peer reviewer for our public task purposes, which may also be used to evaluate our peer review process and report participation statistics.

Current or past employees, visiting workers, students or third party agency workers

We capture and process personal information for the following reasons using contractual, legal obligation, public task and legitimate interest as lawful bases:

• recruitment
• equality and diversity
• personnel files
• rewards and benefits
• training and development
• management information
• pension scheme administration
• accidents, incidents and general health and safety at work
• audit
• prevention and detection of fraud
• occupational health
• payroll
• non-pay staff benefits
• information systems management and delivery
• legal casework: grievances, disciplinary, and dismissal
• workforce planning.

We may share personal information with third parties for the reasons identified above. Third parties may include:

• governmental departments and regulatory bodies in line with statutory requirements, such as:
  • HMRC
  • BEIS
  • anti-fraud organisations
• business partners, such as:
  • UK SBS limited
  • pensions
  • insurers
  • financial services providers
  • medical and health care providers
  • security checks
  • recruitment agencies
  • administration of non-pay staff benefits by the provider.

Further information on how personal information is used by UKRI, our employment policies and our partnership with UK SBS can be found in work for us and our privacy notice on the careers portal.

Taking part in research

This general information supplements the transparency information provided to participants by UKRI research council centres, units and institutes for studies they manage.

UKRI researchers collect and process personal information for the purposes of scientific research using public task as a lawful basis. Where researchers are using special category data. This may include personal information about:

• health
• ethnicity
• political opinions
• religious beliefs.

The added condition of ‘necessary for scientific research in accordance with safeguards’ is used.

The research team undertaking the project will provide further details on the types of personal information used in the study.

It is common for personal information for research to be kept for a long time with periodical reviews for the need to keep it, and the law allows for this. It is also common for research to be undertaken jointly with other research organisations. Data may be shared with other credible research teams, in the UK or abroad, in:

• universities
• commercial companies
• health or social service providers.

Most of the time the data will be depersonalised so you won’t be identified. If it is personal, there are security, legal and ethical safeguards in place to protect your interests.

If you have any questions about the particular research study you are participating in, please use any contact details that have already been provided.

Members of the public

We collect and process personal information for the following reasons using public task and consent as a lawful basis:

• communications and public engagement activities, including:

• • surveys
  • newsletters
  • communications
  • websites
  • social media

• to support your participation in UKRI events, including visits to our sites and other events
• to respond to your enquiries about UKRI and our work
• to investigate and respond to complaints
• evaluation and recording.

We may share personal information with third parties for the reasons identified above. Examples include:

• information on accessibility or dietary requirements to support participation in events
• sharing contact details with third parties supporting our mailing and survey services.

People applying for jobs at UKRI

We currently collect and process the following information:

• personal identifiers, contacts and characteristics:
  • name
  • contact details
  • information about your education
  • details about previous employment and experience
  • details of referees
• information provided by you on a voluntary basis, about your:
  • ethnicity
  • religion
  • gender
  • sexual orientation
  • age.

If you receive a conditional offer of employment, we will collect further information in order to conduct pre-employment screening and check you have the right to work in the recruiting country. This includes:

• information about health which is assessed by an occupational health provider to confirm your fitness to work
• proof of your identity and right to work in the UK
• bank details (so we can pay you and manage your tax and national insurance contributions).

We will also use the information you have provided to enrol you with our pension provider (see ‘Sharing your personal information’).

We also require you to complete a criminal records declaration form and we will use a third party, such as the Disclosure and Barring Service, to check for any unspent convictions. Some positions require additional checks with third parties such as animal rights and credit checks.

This is held under the lawful bases of:

• we have a contractual obligation: our main lawful basis for processing the information you have provided as part of the recruitment process is because it is necessary to do so for us to enter into an employment contract with you
• we have a legal obligation: we also process your information where we have a legal obligation to do so, for example, to check you have the right to work in the UK. Where we collect special category data, this is generally because we have a legal obligation to do so and the additional conditions we must satisfy are because there is a substantial public interest in us doing so or a condition under employment, social security and social protection law
• we need it to perform a public task: we process your information where it is necessary for us to conduct a task in the public interest, such as when we carry out vetting to seek assurance as to trustworthiness, integrity and reliability or on criminal convictions and offences.

Further information on how personal information is used by UKRI, our employment policies and our partnership with UK SBS can be found in the work for us pages of our website and our careers portal.

Sharing your personal information during the recruitment process

We may share your personal information in certain scenarios. For example, if we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority such as the police or the Department for Work and Pensions.

We may also share your personal information if we need to do so in order to exercise or protect our legal rights, users, systems and services.

Your information may also be shared in response to requests from individuals (or their representatives) seeking to protect their rights or the rights of others. We will only share your personal information in response to requests which do not override your privacy interests.

We use the following data processors to help us manage the recruitment process:

• UK SBS
• pensions providers
• pre-employment screening
• occupational health screening
• UK visa and immigration
• recruitment agencies.

We also use Taleo which is the platform for managing recruitment, along with other third-party suppliers of IT services and software.

How we store your personal information on our recruitment system and for how long

Your information is stored securely on Oracle’s UK Gov Cage and the servers are based in the UK.

We will keep your personal information for the purposes set out in this notice and in accordance with the law and relevant regulations.

We will never retain your personal information for longer than is necessary. If there hasn’t been activity on your candidate profile for 12 months, your data will automatically be deleted, should you want your details removed before this time you can deactivate your account in your candidate profile.

Please note that doing so will withdraw all active applications.

Children and young people

We may collect and process personal information about children and young people, such as:

• name
• school
• age
• characteristics including dietary and disability details.

This is to enable us to carry out the aspects of our statutory role relating to education, promotion and public engagement.

We may also use that data to inform decisions about funding, future programmes, and monitoring and reporting of our activities. Such activities are all considered by UKRI to be in the substantial public interest and further to its statutory foundations using public task or consent as our lawful basis.

Where it is appropriate to do so, UKRI will request the consent of the child or young person or a responsible adult.

How long we keep your personal information

We may retain personal information based upon business requirements, legal obligation, statutory or regulatory obligations and transactional purposes.

If you want to know how long we keep personal information, please contact our data protection officer.

Email: dataprotection@ukri.org

Sharing personal information outside of the UK

We are based in the UK, but we also have international representation and work with partners across the globe.

Where we share personal information outside of the UK, we’ll make sure we put in place suitable safeguards to ensure compliance with UK data protection legislation, such as:

• technical measures
• contractual agreements
• data sharing agreements.

Media and images

We process images and recordings for the purposes of:

• CCTV
• security
• communication and broadcast
• general public engagement
• health and safety.

This is in accordance with the Information Commissioner’s Code of Practice.

Your rights as a data subject

Under data protection law, you can exercise your rights according to the lawful basis used for processing. All individuals have the right to:

• to be informed about how your information is being processed
• access a copy of your personal information
• rectification if your personal information is inaccurate or changes.

And then the following rights are determined by the lawful basis:

• erasure
• restrict processing
• object to
• portability
• not be subject to a decision based on automated processing, including profiling.

When you contact us to exercise your right, we will:

• respond to acknowledge your request has been received
• write to tell you if your request is not applicable and give the reasons why
• act on your request within the time period as per the current data protection law
• write to inform you if we need to extend the period of time required to respond due to the complexity
• discuss with you the exemptions to most of these rights in research, depending on the circumstances. The law does not allow any exemption to your rights to be informed or to restrict processing.

How and when you can withdraw consent

Where consent has been used as the lawful basis for processing your information, you have the right to withdraw said consent.

You can do this, by contacting our data protection officer.

Email: dataprotection@ukri.org

When you have provided consent to take part in research, it is unlikely to be the lawful basis for processing personal data, but this consent can still be withdrawn or amended.

If you wish to do so, you need to contact the study team directly.

UKRI does not make any decisions that are based solely on automated processes.

However, there are areas where automated processes are used to support the decision-making process such as tools that can identify applications for research and innovation funding which may breach our eligibility criteria.

All final decisions are made by UKRI employees.

Changes to this privacy notice

Changes to the Privacy Notice will be listed below, starting with the most recent.

1 June 2021

The following changes were made:

• expansion to our recruitment section
• addition of anti-fraud information
• addition of information regarding purchases
• expansion of information regarding awards and ceremonies.