Record of Processing Activity (ROPA)
The University of Manchester is a data controller as defined by the UK General Data Protection Regulation and the Data Protection Act 2018 and as a consequence it's required to maintain a ROPA.
The University processes large volumes of personal data. Our data processing activities take place across the entire University, including: IT Services; Finance; Human Resources; Communications and Marketing; The Directorate for the Student Experience; Estates, Compliance and Risk; and Legal Affairs.
The ROPA (Excel, 19KB) details the categories of data subjects and personal data that we process, as well as the purpose of the processing along with any recipients the personal data may be shared.
Please see below for further details about our ROPA.
The University processes the personal data of:
- Students
- Staff
- Prospective staff
- Unsuccessful applicants (staff)
- Unsuccessful applicants (students)
- Volunteers
- Former staff
- Prospective students
- Alumni
- Former students (withdrawn)
- External Third Parties
- Donors
- Exchange students (incoming)
- Visitors
- Parents, guardians and carers of students
- Contractors
- Industry/Business contacts
- Complainants and enquirers
- Suppliers (eg goods and services)
Categories of personal data processed by the University are:
- Biographical and family details
- Contact information
- Next of kin and emergency contact information
- Survey/feedback information
- Student record and academic data
- Employment record and data
- Financial details
- Contract record information – including external third parties
- Misconduct, disciplinary and grievances investigations and outcomes
- Qualifications and professional memberships information
- Consent record information
- Health and disability data
- Criminal conviction information (offences and alleged offences)
- Equality information
- Vetting and barring checks
The University processes personal data for the purposes of:
- Providing education and support to our students
- Staff administration
- Safeguarding the health and safety of our staff, students and third parties
- Management and administration of University research
- Financial purposes
- Data security and integrity management
- Statutory returns and other legal obligations
- Marketing
- Alumni engagement management
- Event promotion management
- Fundraising and donation management
- The prevention and detection of crime
- Students’ Union administration
- Contractor management
- Procurement
In certain circumstances the University must share personal data with a third party if this is required by law or because it otherwise deems it to be necessary to achieve a specified purpose. The University of Manchester complies with the UK General Data Protection Regulation and the Data Protection Act 2018 when disclosing personal data.
The categories of recipients for personal data are:
- Suppliers and service providers, including for the administration of travel
- New and previous employers
- Regulatory bodies including the Office for Students (OfS)
- UCAS
- Third party statistical agencies, including HESA
- Governmental bodies including UKV&I, ESFA and DSA
- Local Councils
- SLC
- Awarding bodies
- Work experience or other placement providers
- Accommodation providers
- Student support – providers
- Parents, guardians and carers
- Auditors
- Police services
- Students’ Union
- Legal representatives
- International agents
- Research councils
The University has relationships with institutions and agencies outside of the UK which encourage and facilitate international learning and research.
In addition, The University of Manchester Worldwide operates five international centres of the University located in UAE (Dubai), The People’s Republic of China, Hong Kong SRA, Singapore and Brazil. Where we transfer personal data outside of the UK as part of these relationships, we ensure appropriate contracts or other safeguards are in place.
The University retains personal data in line with its Records Retention Schedule, which forms part of its Records Management Policy.
Find out more
Data Protection Officer: Tony Brown (dataprotection@manchester.ac.uk)
Data controller: The University of Manchester, Oxford Road, Manchester, M13 9PL
ICO registration number: Z6787610
Further information is available from the Information Commissioner’s Office register.
The University of Manchester is a public authority under the Freedom of Information Act 2000.