Accessibility statement

Ideas, brain & research icons arranged in a circle

Research Participants: How we use your personal information

1. Why have I been directed to this webpage?

The general information published on this page is intended to supplement the specific information that you have already been given (for example, on a participant information sheet) in connection with your participation in a research study or project run by York Trials Unit researchers at the University of York. The information below applies to all studies and projects that we run. In the unlikely event that there is any contradiction between this information and the specific information that you have already been given, the specific information takes precedence.

2. Who will process my personal information?

The information published here applies to the use of your personal information by the Department of Health Sciences at the University of York. You have already been told if you are participating in a research study that the University is running jointly with other organisations, such as other universities or hospitals.

You have already been told about the types of personal information we will use in connection with the specific research study or project you are participating in and (where applicable) its sources, any data sharing or international transfer arrangements, and any automated decision-making that affects you.

3. What is the purpose and legal basis of the processing?

Under the General Data Protection Regulation (GDPR), the University has to identify a legal basis for processing personal data and, where appropriate, an additional legal basis for processing special category data.

In line with our charter which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:   

Processing is necessary for the performance of a task carried out in the public interest

Special category data is processed under Article 9 (2) (j):

Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes

Research will only be undertaken where ethical approval has been obtained, where there is a clear public interest and where appropriate safeguards have been put in place to protect data.

In line with ethical expectations and in order to comply with common law duty of confidentiality, we will seek your consent to participate where appropriate. This consent will not, however, be our legal basis for processing your data under the GDPR.  

4. How will you keep my data secure?

The University will put in place appropriate technical and organisational measures to protect your personal data and/or special category data.

Information will be treated confidentially and shared on a need-to-know basis only. The University is committed to the principle of data protection by design and default and will collect the minimum amount of data necessary for the project. In addition, we will anonymise or pseudonymise data wherever possible.

5. How can I access my personal information?

Various rights under data protection legislation, including the right to access personal information that is held about you, are qualified or do not apply when personal information is processed solely in a research or archival contact. This is because fulfilling them might adversely affect the integrity of, and the public benefits arising from, the research study or project.

The full list of (qualified or inapplicable) rights is: the right to access the personal information that is held about you by the University (further details are published here), the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, or to object to processing (including the receipt of direct marketing) or to receive an electronic copy of the personal information you provided to us.

If you have any questions regarding your rights in this context, please use the contact details below.

6. How long is my information kept?

You have already been told about the long-term use (and, where applicable, re-use) and retention of your personal information in connection with the specific research study or project you are participating in. General information about how long different types of information are retained by the University is published here.

7. What rights do I have in relation to my data?

Under the GDPR, you have a general right of access to your data, a right to rectification, erasure, restriction, objection or portability. You also have a right to withdrawal. Please note, not all rights apply where data is processed purely for research purposes.

Further information.

8. Who can I contact?

If you have any questions about the particular research study you are participating in, please use any contact details you have already been supplied with.

If you have any general questions about how your personal information is used by the University, or wish to exercise any of your rights, please consult the University’s data protection webpages. If you need further assistance, please contact the University’s Acting Data Protection Officer at

University of York: General Privacy Notice

9. How do I complain?

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, please follow this link.