How the University of Oxford uses personal data for research purposes

The information on this webpage is relevant to you if you:

1. agreed to participate in a research study or project run by academic researchers at the University of Oxford; and/or
2. provided your personal data to another organisation who has passed on that data to the University of Oxford for research purposes.

In relation to case (a) above, the general information on this page is intended to supplement the specific information that you have already been given (for example on a participant information sheet or a consent form) in connection with your participation in a research study or project run by academic researchers at the University of Oxford.

That specific information is meant to provide details such as the types of personal data being used in the study, how we are collecting that data from you and/or from other sources, and whether the University is collaborating with any other organisations to run the study (for example other universities, hospitals, or sponsors of the research). If there is any contradiction between this general information and the specific information that you have already been given, the specific information will take precedence.

In relation to case (b) above, we will have obtained your personal data subject to assurances from such other organisation that it is legally entitled to share that data with us for research purposes. The information below explains how we will handle that data and our commitment to protect your privacy and comply with data protection laws.

Your personal data will be used by the University of Oxford, including its relevant departments and research units, and any other organisations who are involved in carrying out the study together with the University of Oxford. These may include other universities or hospitals, or commercial entities sponsoring the research. You will have already received specific information about such organisations if your data was collected specifically for a University of Oxford-run study.

It is possible that in the future, we may share minimally identifiable data with other academic or commercial organisations we collaborate with to carry out further related research (where this is in the public interest or necessary for the purposes of another organisation’s legitimate research interests). We will always make sure that any such sharing for further research is done in compliance with data protection laws, and under terms that protect your privacy and the confidentiality of your data.

We may also disclose your personal data to our third party service providers or subcontractors in connection with any of the research activities described above. Activities that may be carried out by third-party service providers include IT services and survey provision services. All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service provides to use your personal data for their own purposes, but rather to only process your personal data for specified purposes and in accordance with our instructions.

Your personal data may be transferred to, and stored at, a destination outside the European Economic Area, in accordance with the law. For example, this may happen where we use IT systems which are hosted outside the EEA. We will make sure that identifiable data is removed whenever possible and that any data transfer is done securely. If any foreign country to which data is transferred does not have equivalent data protection standards to those required in the UK, appropriate safeguards will be adopted to protect and maintain the confidentiality of your data (including using standard data protection clauses adopted by the European Commission, where relevant). If you require any information about these safeguards, you may contact us (see data protection officer email address below).

In general terms, we use your personal data (which may in certain instances include sensitive or “special category” data such as health data, or data revealing racial or ethnic origin, among other information) to carry out academic and/or translational research in the public interest. This is known as our legal basis for processing personal data under data protection law.

Your personal data may also be used for further research beyond the initial study where this is in the public interest or where necessary for the purposes of another organisation’s legitimate interests in such research, provided that your interests and fundamental rights do not override those interests. This will be done in accordance with the law and by sharing and using minimal personally identifiable information – fully anonymising it whenever possible. We will only use any personally identifiable data to the extent necessary to achieve such research purposes.

Please note that your consent to use your personal data (which we rarely request) is separate from your ethical consent to participate in a particular research study. You are not legally or contractually obliged to supply us with your personal information for research purposes.

If we collected your personal information directly from you, you have already been told about the long-term use (and, where applicable, re-use) and retention of your personal data in connection with the specific research study or project you are participating in.

As outlined in section 3 above, we may also retain your personal data for further research for which a legal basis exists, and this will always be done in accordance with data protection laws. General information about how long different types of information are retained by the University can be found in the University’s Policy on the Management of Research Data and Records.

You have certain rights with respect to your personal data. These include being able to request access to it, correction of any mistakes in it, deletion of it, restriction of its use, as well as being able to object to any processing of it (i.e. any use of it), or request that it be transferred elsewhere.

However, depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.

If you have any questions about how your data will be used in the study, please use the contact details you will have been provided with by the study organisers.

If you would like to exercise any of your rights mentioned above or if, for any reason, you are not happy with the way that we have handled your data, please contact the University’s Information Compliance Team at data.protection@admin.ox.ac.uk. The same address can be used to contact the University’s Data Protection Officer.

If you are still not happy, you have the right to make a complaint to the Information Commissioner’s Office.