Working from home: Data Protection Guidance

Yes. The General Data Protection Regulation (GDPR) and Data Protection Act 2018 applies to homeworking. For further information on the key requirements of the GDPR and Data Protection Act 2018 see the University’s Data Protection web pages.

Use University of York approved systems only, these are recorded on the Systems Register. If you think an entry is missing let us know. Remember to follow the University’s Policy for safe use of University information on all devices.  In addition, make sure you understand and comply with the University’s IT Security Guidance. For a condensed version see, IT security - a condensed guide.

Our Data Protection responsibilities extend to the suppliers that we appoint and entrust with data. The University must be able to demonstrate that data protection has been appropriately assessed as part of system procurement and implementation. If you’re looking to introduce a new system notify the University’s Data Protection Officer via email at dataprotection@york.ac.uk. Working with IT Services, we can support you to introduce secure and compliant services.

Try to maintain a similar level of privacy when working from home as you do when on campus. For example, consider carefully where you position your computer equipment to ensure your screen is not visible to others. Lock your device when stepping away from work and log out of University of York applications at the end of the day. In addition, be mindful you may be sharing your workspace with individuals not employed by the University so consider carefully the appropriateness of having certain conversations in front of them.

Try to avoid emailing documents back and forth. Instead, use GSuite to share documents with colleagues. Where data is to be transferred by email, use the University’s Staff and Student Directory to find contact details and double check address details before clicking send. For guidance on when to encrypt data sent by email, see IT Services Information classification & handling Scheme. 

Notify the University’s Data Protection Officer immediately via email at dataprotection@york.ac.uk. For further information on recognising data breaches, see the University’s Data Breach Notification Procedure. 

For further information on data protection best practice, including guidance on undertaking data protection compliant research see the University’s Data Protection web pages. Specific questions can be directed to dataprotection@york.ac.uk.

Yes. Ensure you have completed the mandatory online data protection training module. The module can be accessed via HR’s statutory and compliance training page. Casual workers, temporary staff and individuals with associate account status should complete the training package available at HR’s mandatory training for temporary staff page.