)
About this notice
The University of East Anglia processes personal data as both a data controller and as a data processor to ensure compliance with data protection requirements.
Such activities include: data breach investigations, data protection complaints, fulfilling data rights requests, and auditing data processing activities. This can apply to any and all data processed by the University.
Types of data collected
Any types of personal data already held by the University - as set out in our other privacy notices - may be processed for during a data protection audit, in fulfilling a rights request or investigating data protection breach or complaint.
To process requests, complaints and investigations the University will also process: names, contact details, and unique identifies.
Lawful basis for using your data
Data protection processing activities are undertaken to fulfil our legal obligations as set out in the UK's data protection legislation.
How long we keep your data
We will store personal data only as long as is necessary to fulfill our purposes. The length of retention is determined by the nature of processing, and is documented in our Retention Schedule.
Data processing
The University will securely store your personal data on our local IT servers and within locked filing systems. We may contact you via email; the University uses the Microsoft Corporation as our email provider.
The University will not transfer your personal data outside of the United Kingdom.
The University will not undertake automated decision-making or profiling with your data.
The University will not share personal data to any third party unless a lawful basis exists or where we are required to do so by law.
Further information
For more information about the processing of personal data by the University, you can contact our Data Protection Officer by emailing dataprotection@UEA.ac.uk
Changes to this notice
This privacy notice was last updated on 07 November 2025.