Skip to main content

Covid-19 testing: processing personal data of staff and students

As part of the response to the Covid-19 pandemic, BU will need to carry out additional processing of staff and student personal data. Your information will be processed where this is necessary for the purposes of public health and to safeguard vulnerable people. This will usually happen where either you or someone else you have been in close contact with tests positive for Covid-19, or if government guidance indicates you need to self-isolate or quarantine for another reason related to Covid-19.

The approach set out in these privacy notices has been approved by BU’s Major Incident Group as part of the preparations for re-opening BU’s campuses in August 2020. Going forward individual decisions on the processing of this information (including decisions on disclosure of information to NHS Test and Trace and/or other public health authorities and decisions on internal use of information) will be taken by Karen Parker (Director of HR Services) or her nominee in respect of staff information and by Mandi Barron (Director of Student Services) or her nominee in respect of student information. We will keep our approach under review and change it if required in light of changes to the law or government guidance. 

When we refer to “public health authorities”, we mean any organisation with public/government functions in relation to public health. This will include Public Health England and any organisation which replaces it or works with it in relation to infection control activities, and local public health authorities.

The following principles will be applied in making individual decisions about processing of personal data related to Covid-19, i.e. information relating to identifiable individuals:

  • Processing of personal data will be minimised. This means that we will only process information in a form which identifies individuals (rather than being anonymised) where this is necessary for the relevant purposes, and we will put appropriate protections in place to minimise potential access to identifiable information. The names of individuals will only be shared if necessary.
  • BU will only disclose personal data externally where this is requested by a relevant government, NHS or public sector organisation and we are satisfied that the disclosure is required by law or necessary for the performance of a public task (such as protection of public health)
  • BU will comply with the Data Protection Policy in processing personal data for these purposes.

Catering services at BU are provided by our contractor Chartwells. They are separately responsible for processing customer information for the purposes of the NHS test and trace process and will provide you with privacy information about this if it’s relevant to you when using their services.

Your data protection rights

Under the data protection laws, you have a number of rights in relation to our processing of your data. In summary, these are:

  • Right to request access to your data as processed by BU and information about that processing [“subject access request”]
  • Right to rectify any inaccuracies in your data
  • Right to request erasure of your data from our systems and files
  • Right to place restrictions on our processing of your data
  • Right to object to our processing of your data
  • Right to data portability: where we are processing data that you have provided to us, on the basis of consent or as necessary for the performance of a contract between us, you have the right to ask us to provide your data in an appropriate format to you or to another controller.

Most of these rights are subject to some exceptions or exemptions, depending on the purposes for which data is being processed.

If you have any questions or concerns about our processing of your data in relation to Covid-19, please contact the BU Data Protection Officer (DPO):


Telephone: 01202 962472

Address: Poole House, Bournemouth University, Fern Barrow, Poole BH12 5BB

If you would like to exercise any of your rights as outlined above, you can contact the DPO as above or visit the Data Protection page on our website to access the relevant forms.

We will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. However, as a data subject if you have concerns about our data processing or consider that we have failed to comply with the data protection legislation then you have the right to lodge a complaint with the data protection regulator, the Information Commissioner:

Online reporting:


Tel: 0303 123 1113


Information Commissioner’s Office
Wycliffe House
Water Lane