Internal communications privacy notice

The Internal Communications team is part of the University of Surrey. We are registered as a data controller with the Information Commissioner’s Office (our notification number is Z6346945) and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. We have a dedicated Information Compliance Team who can be contacted via

One of our responsibilities is to tell you about the different ways we collect and use your personal data. This statement provides details about these uses. In addition to this statement, you may be given further information about the uses of your personal data when you use certain services offered by the University of Surrey.

The Internal Communications team holds and processes personal data about staff and students.

For students

The personal data we hold about you consists of:

  • Name
  • University email address
  • Personal email address
  • Degree programme
  • Year of study
  • Faculty and department
  • Course start date and end date
  • Mode of study
  • Fee status.

Which we receive when you start as a student.

For staff

The personal data we hold about you consists of:

  • Name
  • University email address

Which we receive when you start as a new member of staff. We also hold personal email addresses for those staff who have specifically opted in to having internal emails sent to their personal addresses for their convenience.

For both staff and students, the University collects only the data we need and we keep the data up to date and only for as long as it is needed.

We collect and process your personal data in order to:

  • Send you emails providing business critical information
  • Send you emails relating to University news and events to enhance your experience of working and studying at the University
  • Personalise or segment email communications to provide accurate and relevant information to staff and students.

We take our obligations for data handling very seriously and it is therefore important for you to know the lawful basis for us processing your information.

The collection and processing of your personal data is necessary to meet our legitimate interests in providing you with effective internal communications. These legitimate interests are determined through an assessment made by weighing our requirements against the impact of the processing on you.

Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. If you are interested in learning more about this legitimate interest assessment, please contact

The data we collect is uploaded to a mailing list through our email service provider, Dotdigital, in order to send the aforementioned email content.

Dotdigital uses tracking technologies within its emails. This information produces reports for the Internal Communications team to view how well an email campaign is performing. We analyse the effectiveness of our service at an aggregate level so that no individuals are identified from the data.

The Internal Communications team also uses the information to accurately segment staff and students for personalised email campaigns.

You can read Dotdigital’s privacy policy for more information.

For students

Your data will be removed from Dotdigital once you have graduated from being a student at Surrey.

For staff

Your data will be removed from Dotdigital following notification from IT Services which takes place on a quarterly basis. If you have shared your personal email address with us, please email us should you wish to be removed from our lists at

The data we collect is shared with Dotdigital to provide an email service that allows us to send the aforementioned email content to you.

As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.

If you would like to exercise any of your rights please visit our make a privacy request section.

Make a complaint

If you have any concerns about the way that we have handled your personal data please email the Data Protection team as we would like to have the opportunity to resolve your concerns.

If you’re still unhappy, you have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.