Skip to main content

BU Privacy Notice: Staff personal data relating to Covid-19 testing and self-isolation

In the context of the pandemic, BU may need to carry out additional processing of your information for the purposes of public health and to safeguard vulnerable people.

Disclosure to NHS Test and Trace and other public health bodies

We will disclose information about you to the NHS Test and Trace service and/or other public health bodies if they request it for the purposes of the test and trace process to help minimise transmission of Covid-19. This disclosure would usually be limited to your name, contact phone number and the dates and times when you have been on BU premises during a defined period of time. 

We would receive this type of request if:

  • Someone who has reported Covid-19 symptoms or tested positive for Covid-19 has indicated to NHS Test and Trace that they may recently have been in close contact with you at BU. The person may have identified you individually but not have your contact details, or they may have provided information that they were at BU but not known the names of all the people present in the location at the same time; or
  • BU has notified public health authorities that there have been multiple Covid-19 infections at BU (as we’re required to do under government guidance).

Disclosed information will be used by NHS Test and Trace to contact you if they think you need to self-isolate, and to enable Public Health England to assess and manage any possibility of a local outbreak of Covid-19.

BU expects all staff to comply with their individual responsibilities under the NHS Test and Trace process, as set out here: If your recent close contacts include BU staff or students but you do not have all the requested contact details for them (such as a mobile number), you do not use your access to BU systems (e.g. SITS) to obtain this information for disclosure to NHS Test and Trace. Instead, you should give NHS Test and Trace the information you already hold and ask them to contact BU for any further information.

Covid-19 home test kits 2021

The Department of Health and Social Care (DHSC) has asked universities to support distribution of home test kits to staff and students. BU is working closely with AUB in managing this exercise to support both sets of staff and students.

Prior to 1 September 2021

For health and safety reasons, DHSC needs to be able to trace the end user of a home test kit. To enable this BU is obliged, under its arrangements with DHSC, to set-up and keep a log of those issued with home test kits. This log will cover your first name, surname and contact telephone number, linked to the particular test kit.

The information will be collected by BU staff, or others on BU’s behalf – such as AUB or agency staff, acting as a processor for DHSC.

This information will only be passed to DHSC if they request to see it for health and safety reasons, such as a batch recall, adverse incident investigation or providing a safety notice. BU will not use the information other than to respond to a DHSC request. BU will not hold this information for longer than 12 months after the test kit is provided.

A DSHC privacy notice specific to this processing will be displayed at the point of collection.

As of September 2021

BU, is no longer required to record your name, surname and contract telephone number. BU is still required to provide any assistance reasonably requested by DHSC to identify the location of any testing kits impacted by a product recall. Any existing logs currently held by BU in relation to testing prior to September 2021 will be retained, in accordance with the existing agreements with the DHSC, but for no longer than 12 months from the date on which the relevant data is collected, unless DHSC instructs BU to delete or destroy those logs.

Asymptomatic testing (January – June 2021)

At the request of the government BU is participating in the national asymptomatic testing of students on their return from the Christmas holiday period in January – February 2021, and staff are also able to use this facility to obtain a test if you are not displaying symptoms.  BU’s processing of your personal data for these purposes is limited to the processing required to make arrangements for the testing and to notify you of appointment times and of any changes to appointment times or arrangements.    

All other processing of personal data for the purposes of this testing is carried out by NHS Test and Trace on behalf of the NHS and the Department for Health & Social Care.  

You are asked to email COO Mailbox ( if you would like to be tested.  You will then be notified of a time for you to attend the testing facility.    On arrival at the BU test facility we will need to check that you are a BU staff member: you will be asked to show your staff card or, if you do not have it with you, provide your name so that we can check the records system and confirm your status as a staff member and your appointment details.  However we will not make any record of your attendance or of the personal details we see at this point.  We will only process your appointment details, the data you provide when making an appointment and any communications about your appointment for the purposes of making and managing these testing arrangements as described in this notice. This data will be deleted after 21 days.

After your status has been confirmed you will be provided with a test kit and card and asked to register with the NHS Test portal. You will be notified directly by the NHS of your test result via SMS or to the email you provide when you register with the NHS portal. The University will not have access to any of the registration data you put into the portal and will not see your test results.  The portal and the systems used for tracking and communicating test results are managed by NHS Test and Trace and the Department for Health and Social Care.  Information about how they process your personal data can be found here. 

If you test positive for Covid-19 in this process, please let us know in the same way as for any other positive test (see below).

Managing information within BU: self-isolation and positive Covid-19 test results

If you need to self-isolate under the terms of the government guidance you should contact your line manager to explain the position and make arrangements to work remotely. We will support you in complying with self-isolation requirements. Further information and guidance on self-isolation and/or quarantine can be found on the staff intranet.

If you test positive for Covid-19 and you were at work on BU premises at any point from two days before you started showing symptoms until seven days after you showed symptoms, we would ask you to let us know by emailing This mailbox can only be accessed by a limited number of staff, who will keep your information strictly confidential. We will use this information to identify any steps we should take to help ensure a safe environment for staff and students. These might include additional cleaning, further risk assessment of particular activities and notifying staff and/or students that they have been in contact with someone who has tested positive. We will not disclose your name to others at BU as the person who has tested positive.

If you are waiting for the results of a Covid-19 test, if you wish we can support you in alerting colleagues or students with whom you’ve been in recent close contact, in line with the government guidance. Again we will not use your name when passing on this information.

If you tell us that you have received a positive Covid-19 test, we will not disclose information about your Covid-19 status to any external organisation unless required by law or guidance, such as if we receive a request from NHS Test and Trace or public health authorities for information required to perform their public health and safety roles (see section above). It is for individuals to provide this information to NHS Test and Trace as required under the government guidance, and we will not routinely do so. We will, however, use this information within BU on a confidential basis for the purposes of managing risks to the health and safety of staff and students.

We will use data we hold about dates and times when you were at work on BU premises to decide whether we need to contact you to tell you that you may have been in contact with someone who has tested positive for Covid-19.

While the pandemic continues we may record some additional data about dates and times when you have been at work on BU premises – for example by keeping details of requests to work on campus or rotas where relevant (we are not planning to use tracking technology to record individuals’ presence on BU premises). We will record and keep this data if this is a legal requirement (e.g. under the requirements for certain types of service and facility such as the Library and the SportBU gym). This information will only be kept for 21 days and we will use it only for the purposes described above. For these purposes, we may also use timetabling information (where relevant) to identify when you were at work on BU premises.

Legal basis under data protection law

Under the data protection legislation we need to identify and explain the legal basis for the processing of your personal data. For the uses of your data described above we consider this to be:

  • For disclosure as part of NHS Test and Trace and wider public health measures, necessary for the performance of a public task: the public task of the NHS and public health authorities in controlling the spread of Covid-19;
  • Necessary for the performance of our public task as a university, which includes providing a safe learning and teaching environment;
  • Necessary for compliance with legal obligations on BU, i.e. where there is a legal requirement under the Covid-19 legislation to record staff and/or service-user data for Test and Trace purposes;
  • Necessary for legitimate interests, i.e. ensuring health and safety within the university environment. We consider that the scope of data being processed and the way in which we will process it means that our approach is proportionate and the legitimate interests are not outweighed by damage to the rights of the individuals.

Where you tell us that you are experiencing Covid-19 symptoms or that you have tested positive for Covid-19, this is “special category data” which requires an additional legal basis. This is that it is necessary for carrying out BU’s health and safety obligations as an employer and social protection in respect of both staff and students (Article 9(2)(b) GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018); and safeguarding of individuals at risk (Article 9(2)(g) GDPR and paragraph 18 of Schedule 1 to the Data Protection Act 2018).