Complaint privacy notice

When you make a data protection complaint to the University of Edinburgh, you provide information about yourself. This privacy notice sets out how the University processes your personal data.

Purposes

We use this information for the following purposes:

1. To process your complaint

   The Data Protection Officer uses information about your complaint, including your identity, contact details and relationship and interactions with the University, staff and students, to investigate your complaint.

2. To administer your request and keep a record of it

   We keep records of all data protection complaints. This includes case folders containing our correspondence with you about your complaint and database records containing your name, contact details, a summary of your complaint and your relationship with the University (if known).  We use this information to ensure that the University complies with our legal obligations and can demonstrate and monitor our compliance.

Why we do this

We use information about you and your request to comply with our legal obligation to respond to data protection complaints, and to fulfill our public tasks under:

• The General Data Protection Regulation, 27 April 2016 (‘UK GDPR’)
• The Data Protection Act 2018 (‘DPA’)

Data sharing

We will not share your personal data with an external third party unless required to do so under the law, such as to respond to an escalation of a complaint to the Information Commissioner's Office. 

Retention times

Records concerning your complaint will be kept for six years after the complaint investigation has been concluded fully. Should your complaint be escalated to the Information Commissioner's Office, the records will be retained six years after a decision has been obtained.

Continued privacy notice

 Continued privacy notice