GDPR & Data Protection

The General Data Protection Regulation (GDPR) has been in place since May 2018. It governs how personal data is collected, stored, and used by organisations, including Keele University, Keele SU, and your student group.

⚠️ Getting it wrong can lead to serious legal and financial consequences — not just for the SU, but potentially for you and your committee too.

Keele SU has built systems and tools that are GDPR-compliant — you must use these to ensure your society is protected under our data protection policies and the University’s.

If you go outside these systems (e.g. using personal email accounts or spreadsheets), you risk breaching GDPR and exposing yourself and others to legal action.

• Only use your @keele.ac.uk society email account.
• Never collect or store data using personal emails or unauthorised platforms.
• Report any unofficial accounts to the SU immediately.

• Only collect what you need — no more, no less.
• Always explain why you’re collecting data and how it will be used.
• Use anonymous surveys where possible.
• Never collect contact details at fairs — use the “I’m interested, tell me more” feature on the Keele SU website instead.

• Store data on secure, password-protected platforms.
• Limit access to only those who need it.
• Know who on your committee is responsible for managing data.

• Keep data accurate and up to date.
• Have a plan for deleting old data — this is done automatically on KeeleSU.com and your society email/Teams channel.

If you’re collecting data, provide a privacy notice explaining:

• What data you’re collecting
• Why you’re collecting it
• How long you’ll keep it
• How people can update or delete their data

If you suspect a data breach, email su.itsupport@keele.ac.uk right away with the subject line “Data Breach”.

• Keele SU Data Protection Policies
• Keele University Data Protection Policy

Committee Presidents and Club Captains should familiarise themselves with these policies and know who to contact if they have questions.