Skip to main content

Privacy notice

UK Research and Innovation (UKRI) understands the importance of protecting personal information and is committed to complying with the General Data Protection Regulation 2016/679 (GDPR).

We are committed to fostering a culture of transparency and accountability by demonstrating compliance with the principles set out in the regulation – as laid out in our Data Protection Policy (PDF, 81KB).

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

UKRI (‘we’, ‘our’ and ‘us’) brings together seven research councils, Innovate UK and Research England and is established by the Higher Education and Research Act 2017 Articles 91, 92 & 93. We are registered with the Information Commissioner’s Office with the number za333592.

UKRI is the data controller of your personal information and our registered office is: Polaris House, Swindon SN2 1FL.

Our data protection officer (DPO) is:

David Hyett
Head of Information Governance
Polaris House
Swindon
SN2 1FL

Email: dataprotection@ukri.org

If you have a question or concern about how your personal information is being handled then please contact our DPO. You also have a right to raise issues with the Information Commissioner’s Office.

Your use of this website is also subject to our terms of use.

The kinds of personal data we process about you

When we ask you for personal data, we will:

  • tell you why we need it
  • only ask for relevant information
  • look after it and make sure it is only accessible to those within UKRI who need to see it
  • only keep it for as long there is a business, statutory or legal obligation (see our retention policy below)
  • not make your personal information available for commercial use without your permission

In return, we ask you to:

  • give us accurate information
  • tell us as soon as possible if there are any changes

Across our organisation, we may collect the following types of personal information about you:

  • personal contact details
  • date of birth
  • nationality
  • bank account
  • equality, diversity and inclusion information
  • career/workplace/employer/research/innovation
  • dietary and accessibility needs

This does not necessarily apply to you if you are taking part in research – see below for more information.

Why we process personal information

When we carry out processing in pursuit of our purposes laid out in Article 93 of the Higher Education and Research Act 2017, in the most part, our lawful basis for processing your personal information falls under ‘public task’.

The processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We also make use of contractual, legitimate, and consent-based processing.

The purposes for which we might process your personal information are outlined below, depending on your relationship with us.

Users of the UK Research and Innovation and council websites

We may collect and process the following information:

  • information that you provide by filling in forms or surveys
  • information in correspondence that you send us
  • details of your visits to our website including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access

We may use personal data we collect to:

  • ensure that our website content is presented in the most effective way for you
  • provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes
  • allow you to participate in interactive features of our service, when you choose to do so
  • notify you about changes to our website or services

We do not generally provide any personal information about users of our website to third parties or other users. However, we may disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to:

  • comply with any legal obligation
  • enforce or apply our terms of use and other agreements
  • protect the rights, property, or safety of UK Research and Innovation, or others

Members of our research and innovation communities

We capture and process personal information about members of our research and innovation communities on the basis of public task to:

  • manage funding applications and awards
  • alert you to funding opportunities
  • operate the peer review process (including portfolio analysis)
  • undertake portfolio analysis and support the evaluation of our strategy and policy to investigate the effectiveness of our programmes (this may include evaluations of equality, diversity and inclusion)
  • undertake collection, monitoring and evaluation of research outcomes
  • support participation in events and workshops (this may include surveys and collecting information on dietary and accessibility requirements)
  • ensure our terms and conditions of funding are met, including audit and assurance processes, research integrity, misconduct processes and fraud prevention
  • operate our complaints policy (research conduct)
  • manage access to research services, data and facilities
  • facilitate commercialisation and technology transfer

We may share your personal information with third parties where we need to engage with them for the purposes listed above.

Members of the UK Research and Innovation Board or council and peer review boards and committees

We capture and share personal information to manage governance processes for our public task.

Peer reviewers

We capture and share personal information of peer reviewers so you can participate in our public task. Information may also be used to report participation statistics.

Current or past employees, visiting workers, students or third party agency workers

We capture and process personal information using contractual, legal obligation, and legitimate interest as a lawful basis for the following reasons:

  • recruitment
  • equality and diversity
  • personnel files
  • rewards and benefits
  • training and development
  • management information
  • pension scheme administration
  • accidents, incidents and general health and safety at work
    audit
  • occupational health
  • payroll
  • non-pay staff benefits
  • information systems management and delivery
  • legal casework – grievances, disciplinary, and dismissal

We may share your personal information for the above purposes with:

  • other government departments and regulatory bodies as a statutory requirement, such as:
    • Information Commissioner’s Office
    • HMRC
    • BEIS
  • business partners, such as:
    • pensions
    • insurers
    • financial services
    • medical
    • UK SBS
    • security checks
    • recruitment agencies
    • administration of non-pay staff benefits by the provider

Members of the public

We capture and process personal information using public task and/or consent as a lawful basis for the following reasons:

  • communications and public engagement activities including surveys, events,
  • newsletters, communications, websites and social media
  • queries and complaints
  • evaluation and recording

We may share your personal information for the following purposes:

  • to send you information about our work
  • to manage your attendance at meetings outside of our own sites

Suppliers

We capture and process personal information using contractual and legitimate interest as a lawful basis for the following reasons:

  • site management (building access, car parking)
  • health and safety
  • dietary and accessibility requirements
  • equality reporting
  • service provision and management

Taking part in research

The general information below supplements the specific information you have already seen if you are taking part in research studies managed by research council institutes.

UKRI researchers capture and process personal information for the purposes of scientific research using public task as a lawful basis. Where researchers are using special categories of personal data (this includes data about for example your health, ethnicity, political opinions, and religious beliefs), the added condition of ‘necessary for scientific research in accordance with safeguards’ is used.

The research team undertaking the project will provide you with information on the types of personal data used in the study.

It is common for personal data for research to be kept for a long time, with periodical reviews on the need to keep it. The law allows for this. It is also common for research to be undertaken jointly with other research organisations. Data may be shared with other credible research teams in universities, commercial companies, and health or social service providers in the UK and abroad. Most of the time the data will be depersonalised so you won’t be identified. If it is personal, there are security, legal and ethical safeguards in place to protect your interests.

If you have any questions about the particular research study you are participating in, please use any contact details that have already been provided.

Children and young people

We may collect personal information about children and young people (such as name, school, age, and characteristics including dietary and/or disability details) to enable us to carry out our statutory role relating to education, promotion and public engagement.

We may also use that data to inform decisions about funding, future programmes, and monitoring and reporting of our activities. Such activities are all considered by UKRI to be in the substantial public interest and further to its statutory foundations using public task or consent as our lawful basis.

Where it is appropriate to do so, UKRI will request the consent of the child or young person or a responsible adult.

How long do we keep your personal information?

We may retain your personal information based upon business requirements, legal obligation, statutory or regulatory obligations and transactional purposes.

If you want to know how long we keep your information, please write to our data protection officer at dataprotection@ukri.org

Sharing personal information outside the UK

We are based in the UK, but we also have international representation across the globe. Where we share personal information outside the UK, we’ll make sure we put in place suitable safeguards to ensure compliance with the GDPR, such as technical measures, contractual agreements or data-sharing agreements.

Media and images

We process images and recordings for the purposes of CCTV, security, communication and broadcast, general public engagement and health and safety in accordance with codes of practice and guidelines laid down by the Information Commissioner’s Office.

What are your rights as a data subject?

Under data protection law, you can exercise your rights according to the lawful basis used for processing.

All individuals have the right to:

  • be informed about how your information is being processed
  • access a copy of your personal information
  • rectification if your personal information is inaccurate or changes
  • erasure in certain circumstances
  • restrict processing in certain circumstances
  • object to processing in certain circumstances
  • portability: to obtain and reuse your personal data for your own purposes
    not be subject to a decision based on automated processing, including profiling

When you contact us to exercise your right, we will:

  • acknowledge your request has been received
  • write to tell you if your request is not applicable and give the reasons
  • act on your request within the time period required by the current data protection law
  • write to inform you if we need to extend the period of time required to respond due to the complexity
  • discuss with you the exemptions to most of these rights in research, depending on the circumstances. The law does not allow any exemption to your rights to be informed or to restrict processing

How and when can you withdraw consent?

Where consent has been used as the lawful basis for processing your information, you have the right to withdraw that consent.

You can do this, by contacting our data protection officer at dataprotection@ukri.org

When you have provided consent to take part in research, it is unlikely to be the lawful basis for processing personal data, but this consent can still be withdrawn or amended.

If you wish to do so, you need to contact the study team directly.

Do we make use of automated decision-making or profiling?

No

Changes to this privacy notice

We may change this privacy notice and we encourage you to check this privacy notice from time to time.

NOTEThis is the first phase of our new website – let us know if you have feedback or would like to help us test new developments.