Privacy Notice: How your personal data is handled within Report + Support 

This form is used to collect information from you regarding incidents and/or concerns. 

The University of Surrey is the “Data Controller” of your personal data. We are registered with the Information Commissioner’s Office (our notification number is Z6346945) and we are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. We have a named Data Protection Officer, Suzie Mereweather, who can be contacted via 

What information do we collect from you? 

You have the option to give as much or as little information as you want in response to the questions asked in this form. 

Why do we collect this information? 

We use the information you provide for the purpose of: 

  • Helping us to identify the best person for you to speak to in relation to your report;
  • Providing the person with your contact details (if you have provided them) and some useful background information that will enable them to understand the nature of your concern or the incident you are reporting;
  • Where applicable, reviewing your report and taking further action if required. For example, an investigation could lead to us carrying out disciplinary action. You can read more about this on the webpage for the Office of Student Complaints, Appeals and Regulation at .  We will always talk to you to discuss your report before taking any action.  
 We will write to you to keep you informed about what we are doing. 

  • Once we have concluded any actions we have taken, we will write to you to inform you of the outcome.
  • Monitoring patterns or trends in data that will be used to inform our proactive and preventative work. 
When reporting anonymously, we will not ask you for any personal identifiable details. We will not be able to offer direct advice or take any action on the report. 

·       We will keep an anonymised record of your report to identify whether there have been/are other similar reports and whether there is a pattern of behaviour or trends that should be addressed. 

We collect this information because the University has a legitimate interest in ensuring staff and students at the University are safe and receive support for incidents and/or concerns affecting them. 

The University’s legitimate interest is determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. 

You may disclose data considered to be special category data (data revealing health or wellbeing, racial or ethnic origin, political opinions, religious or philosophical beliefs) in this form.  When you do this, we process your data with your consent, which we capture at the end of the form.  

What do we do with your information? 

The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy.  

Access to the data you give is limited to six members of University staff who need to review the data.  

OSCAR review data relating to student complaints; HR review data relating to staff complaints.  Anonymised data is also used to identify any worrying themes or trends to enable the University to respond to these and formulate preventative action.  

 How long do we keep your information? 

We retain your personal information for six months where no action is taken and for 15 months where action is taken in case you wish to ask questions or appeal the decision. After then, we will delete what personal data you have provided. We may retain some information in order to monitor our work in this area but you will not be identifiable from this information. 

Who do we share your information with? 

Your identity and your other personal data will be disclosed within the University of Surrey on a need to know basis only and will not be disclosed to any third parties without your consent unless there are legitimate reasons requiring us to do so, for example, where the information you have provided highlights a potential risk to a person’s health and safety 

What rights do you have in relation to the way we process your data?

As an individual whose data we process (a data subject), you have certain rights in relation to the processing.  You can find detailed information about your rights as a data subject on the University’s webpage.  

  • At any time, you may ask that we stop processing your personal data and that we safely and securely delete the information you gave us.
To exercise any of these rights, please contact  

If you have any concerns about the way that we have handled your personal data please contact us as we would like to have the opportunity to resolve your concerns. You can contact us at 


There are two ways you can tell us what happened