No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

From the Employment and Recruitment Service (ERS) ERS to external clients, this may include providing your details e.g. employment history and skills to external organisations to enhance potential employment opportunities for yourself and to raise awareness of ERS.

Consent

2

With staff in partner organisations e.g. NHS and Knowledge Transfer Partnerships (KTP) that are involved in the recruitment process.

Contract, Employment, social security and social protection

3

With the Home Office to establish or retain a statutory excuse if conducting checks on your right to work.

Legal Obligation, Employment, social security and social protection

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To make travel and accommodation arrangements organised by the University.

Contract, Explicit Consent

2

For administration of the flexible benefits scheme e.g. bus companies, providers of health benefits and lease care hire.

Contract

3

If you are engaged by an external client then the ERS we will share information with them on a need to know basis.

Contract, Employment, social security and social protection

4

With appropriate third parties for the purposes of internal and/or external audit in order to facilitate the assessment and improvement of services that the University offers, to assess the effective management of the University and to ensure the efficient running of the University

Public Task, Substantial Public Interest - DPA 2018, Schedule 1, Part 2, paragraph 8: Equality of opportunity or treatment under equality legislation

5

To IT providers delivering externally hosted IT services or products such as Microsoft

Contract, Legitimate Interests

6

With third parties who help us to monitor IT network infrastructure, traffic and connected devices and users in order to improve services, identify security issues and to comply with legal and contractual obligations

Legal Obligation, Legitimate Interests

7

If we believe a complaint may result in a legal claim being made against the University, we will share relevant and appropriate data with the University insurers and legal representatives. Depending on the details of the complaint/legal claim, this may include both personal and special category data.

Legitimate Interests, Legal claims or judicial acts

8

With the University's insurers for a variety of purposes

Contract, Legal Obligations, Substantial Public Interest - DPA 2018, Schedule 1, Part 2, paragraph 20: Insurance

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To provide your details to external accreditation bodies e.g. ILM so that you can receive accreditation for professional development.

Contract

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To provide your details to external funders such as research councils as part of the research/project proposal and as part of on-going monitoring/auditing.

Public Task

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To outsourced payroll service providers.

Legitimate Interest

2

To transfer relevant information to HMRC and equivalent government bodies in partner institution countries.

Legal Obligation, Employment, social security and social protection

3

To transfer your information to pension administrators e.g. LGPS, Prudential AVCs.

Legal Obligation, Employment, social security and social protection

4

To make attachment to earnings payments e.g. to the Student Loans Company, Lancaster City Council for council tax payments.

Legal Obligation

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To the Higher Education Statistics Agency (HESA) for the analysis of staff information.

Public Task, Substantial Public Interest - DPA 2018, Schedule 1, Part 2, paragraph 6, Statutory and government purposes

2

To the Office for National Statistics (ONS).

Legal Obligation, Public Task, Substantial Public Interest - DPA 2018, Schedule 1, Part 2, paragraph 6, Statutory and government purposes

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To gain professional accreditation for schools and courses e.g. AACSB, Equis, AMBA, health and care professions council.

Public Task

No

Purpose

Legal Basis: GDPR and DPA 2018 (where appropriate)

1

To the police or other regulatory body where pursuant to the investigation or disclosure of a potential crime.

Legitimate Interest, Vital interests

2

To close family, next of kin and the emergency services when necessary to protect life of yourself or another person.

Vital Interests, Consent, Explicit Consent

3

To the Universities’ insurers in respect of accidents or incidents occurring with the institution and external auditors and regulators such as the Health and Safety Executive.

Legal Obligation, Substantial Public Interest - DPA 2018, Schedule 1, Part 2, paragraph 6 Statutory or government purposes under relevant Health and safety legislation

4

Where deemed necessary, with appropriate agencies in order to fulfil the University's obligations under the Prevent duty.

Legal Obligation, Substantial Public Interest - DPA 2018, Schedule 1, Part 2, paragraph 6 Statutory or government purposes under the relevant Prevent and other appropriate anti-terror legislation