SOAS University of London

Test and Trace Privacy Notice

1. Who are we and what do we do?

2. What is this document and why should I read it?

3. What personal data is processed?

4. How will your personal data be used, and is it lawful?

5. Who do we share your data with and why?

6. Will my data be transferred overseas?

7. How long will you retain my data?

8. What are my rights?

1. Who are we and what do we do?

SOAS is a provider of higher education. When it comes to information about you, we are a “Data Controller”. That means we decide why and how we store and use your information.

We have appointed a Data Protection Officer whose role is to inform and advise us about, and to ensure that we remain compliant with, data protection legislation. The Data Protection Officer should be your first point of contact if you have any queries or concerns about your personal data.

Our current Data Protection Officer is the Information Compliance Manager, who can be contacted at or 0207 898 4817.

If you think SOAS is processing your data in a way which is unlawful, you can make a complaint to the Information Commissioner’s Office, which is the UK data protection regulator. More information can be found on the Information Commissioner’s Office website at


2. What is this document and why should you read it?

This document explains what personal data SOAS will process to support the NHS Test and Trace service, which is a key part of the country’s ongoing COVID-19 response. It will also explain how this data will be processed, the lawful conditions under which it is processed, details of the data sharing, the length of time data will be retained, and information about your data protection rights.

This document only relates to personal data processed to support NHS Test and Trace. It does not relate to general processing of personal data relating to specific groups within our wider community (such as alumni, staff or students), or types of activities (events, or widening participation activity). Details of other Privacy Notices can be found here:

You should read this document so that you understand how our use of your data will help SOAS support the NHS tackle localised clusters and outbreaks of the virus.

3. What personal data is processed?

The personal data processed in support of NHS Test and Trace is derived directly from individuals and from our existing systems.

If you fill in a booking form to reserve study space, collect items from your office, pickup or drop off books from the library, utilise our multi-function printers, attend on-site appointments or reserve teaching facilities to record lectures, we will collect the following personal data from you directly:

  • Your name
  • Your email address
  • Your phone number
  • The approximate times of your arrival and departure
  • Any accessibility requirements (optional)
  • The location you will be attending
  • Your Student or Staff ID (for specific services)

We will also use existing data from our line of business systems to assist the process of identifying relevant individuals in the event the School is alerted about a positive COVID-19 case on campus. The types of personal data derived from these systems will not exceed the categories of personal data listed above. We will ensure that the volume of data processed to achieve the purpose is kept to an absolute minimum.

We will not process any Special Category Data, such as information about your beliefs, political opinions, race, sexual life or orientation, health, trade union membership or genetic or biometric data for this purpose.

4. How will your personal data be used, and is it lawful?

The personal data used to support NHS Test and Trace consists primarily of personal data we already hold about you. The only additional information we collect will relate to your location at a specific date and time. It is important for us to collect this data to track building capacity and to understand which individuals may have been in the vicinity of a person reporting positive for COVID-19. This will also help the NHS narrow down the number of people who might need to be contacted.

The purpose of collecting the data is to share it with NHS Test and Trace where requested, to help the NHS identify people who may have been exposed to the virus. Containing outbreaks early is crucial to reduce the spread of COVID-19, protect the NHS and social care sector, and save lives.

Your personal data will not be used for any purpose incompatible with the information in this privacy notice or any other relevant privacy notice you have been given by SOAS.

The processing of your personal data is lawful because it is necessary to perform a task carried out in the public interest.

5. Who do we share your data with, and why?

We will only share your data with NHS Test and Trace where requested. Otherwise, your data will be held securely on systems provided by our contracted partners.

6. Will you transfer data overseas?

We will not transfer any data outside of the European Economic Area. We will only share data with the NHS Test and Trace service, and all of our systems store data within the European Economic Area.

7. How long will you retain data?

Data we hold about you will only be used for sharing with NHS Test and Trace for 21 days from the date you last attended campus, in accordance with government guidelines on the virus incubation period (14 days) and test and trace timeframe (7 days).

Data on booking forms will be held for 120 days for the purpose of generating anonymised statistics to help us understand demand for the booking service.

When we use data from our existing line of business systems to support NHS Test and Trace, the retention period of your data will be in line with the retention policy which relates to that record category. Our retention schedule can be accessed online here: For instance, we may use timetabling data to identify people close to a localised outbreak on campus. Timetabling data is held for 3 years from the end of the academic year to which it relates.

What are your rights?

Right of Access

You have the right to the information which the School holds about you. A guide on how to make a ‘Subject Access Request’, including requirements for proving your identity, is available on our website here: Making a request for your data

Right to correct your data

If you believe data we hold about you is incorrect as to a matter of fact, or if your information changes, please write to us as soon as possible, or use the online services available to you.

Right to restrict processing

If you believe SOAS is processing your data unlawfully, you can ask us to restrict the processing of your data whilst we investigate your complaint. When we restrict your data, we will store it securely to mark it as restricted and won’t process it in any other way.

Right to objection

You have the right to opt-out of us sharing your data with NHS Test and Trace. Because it is necessary for SOAS to take a proportionate approach to support NHS Test and Trace, if you object to having your data shared we kindly ask you not to visit the campus, as it will not be possible to quickly disaggregate opted-out individuals from other individuals in the booking data.

SOAS has put in place measures to ensure that all activities and services can be accessed remotely, so you should not be put at a disadvantage if you cannot attend campus in person.

If SOAS corrects your personal data at your request and that data has been passed to the NHS Test and Trace service, SOAS is responsible for taking reasonable steps to ensure that the corrected data is communicated to them.

If you wish to exercise any of these rights, please contact our Data Protection Officer (contact details in the section Who we are and how to get in touch) in the first instance.