UCC EDI Staff Consultation: Data Protection Notice (DPN) 2026

At University College Cork, we treat your privacy seriously. Any personal data which you provide to the University will be treated with the highest standards of security and confidentiality, in accordance with Irish and European Data Protection legislation. This notice sets out the details of the information we collect, how we process it, and with whom we share it. It also explains your rights under data protection law in relation to our processing of your data.

Introduction 

At the heart of UCC is our diverse community of students and staff - people who bring with them different cultures, languages, perspectives and lived experiences. This richness of backgrounds and ideas is central to who we are as a university and strengthens our teaching, learning and research.

UCC is committed to undertaking biennial all-staff Equality, Diversity and Inclusion (EDI) consultation to measure progress, ensure accountability, share feedback, and inform action (UCC Strategic Action Plan, 2023-2028, Goal 4.2 ii). We want to fully understand and reflect the richness of our staff community in how we operate and how people feel when they study, work, and engage with us on our campus and beyond.

The 2026 EDI consultation comprises three parts:

i) 2026 “Values and Culture” EDI Staff Survey

ii) 2026, 2027 EDI Gathering

iii) Athena Swan School-level focus groups (between 2026-2028, inclusive)

Who we are

Throughout this Notice, “we”, “us” and “our” refer to The Equality, Diversity and Inclusion Unit, University College Cork. For more information about us, please refer to our website: www.ucc.ie/edi.

The “University”, or “UCC”, refers to the University College Cork.

How we collect and store you personal data

We collect your data when you fill in the 2026 “Values and Culture” EDI Staff Survey, when you participate in the EDI Gathering events (in 2026 and 2027), and Athena Swan focus groups (between 2026 and 2028).  This data will be used by us only in accordance with the purposes outlined in this notice. 

Personal data will be stored confidentially and securely as required by the UCC Data Protection Policy. The University is committed to ensuring that the processing of your data is safeguarded by appropriate technical and organisational security measures relevant to the processing in accordance with Article 32 GDPR requirements.

Which personal data we collect

When you complete the survey, you will not be asked for your name, email address, staff number or any other piece of information which will identify you. We will collect data concerning the following:

• Age (in brackets, e.g. 18-24)
• Caring Responsibilities (e.g. Parent/Guardian, Caring for the Elderly)
• Civil Status (e.g. Married, Single)
• Disability Status (e.g. ‘Yes’/’No’ to ‘Do you consider yourself having a disability or ongoing medical condition/illness?’)
• Gender Identity (e.g. Female, Male, Non-Binary, etc.)
• LGBT+ Status
• Race/Ethnic Background (e.g. White Irish, Black Irish, member of the Traveller community, etc.)
• Religion or Belief System (e.g. Christianity, Agnosticism)
• Job Category (e.g. Academic, Researcher)
• Working Arrangements (e.g. Contract Type, Grade)
• Working Life (e.g., working hours, flexible arrangements, leave, workload, etc.)
• Career Progression (e.g., experience of recruitment and induction, promotion, career development support, etc.)
• Discrimination and Unfair Treatment in the Workplace experiences (if any)
• Harassment and/or Sexual Harassment and/or Sexual Violence experiences (if any)
• How can UCC improve your working life

Please note that the University will never use or combine the information you provide to attempt to identify you or any other person. The University will not take any specific action or commence any formal complaint process because of any of the responses you submit.

The purpose and legal basis for collecting your data

The personal data we collect from you will only be processed for specific and lawful purposes as outlined in this Data Protection Notice. The University will ensure that your data is processed fairly and lawfully, in accordance with the principles of data protection as set out in Article 5 of the GDPR. 

 

Purpose

UCC has a legal obligation under the “Public Sector Equality and Human Rights Duty”, which originates in Section 42 of the “Irish Human Rights and Equality Act” (2014) to promote equality, prevent discrimination and protect the human rights of its employees, customers, service users and everyone affected by their policies and plans.   Data gathering and monitoring of the nine characteristics protected under Irish equality legislation are key components in identifying inequality, initiating activity to address it, and evaluating progress, as required by the Public Sector Equality and Human Rights Duty. Data is a key part of understanding where there are disadvantages and under-representation in the University. It will enable us to devise targeted measures to address and mitigate any disadvantages.   As part of the HEA’s ongoing work in staff equality, diversity and inclusion, the “Higher Education Authority Act” 2022 provides a legal basis (subject to the Data Protection Regulation and the Data Protection Act 2018) for Higher Education Institutions (HEIs) to report personal data to the HEA, including gender, ethnicity and disability of staff members. This is likely to expand to the collection and reporting of personal data on all nine protected characteristics under Irish equality legislation to the HEA in the future. Athena Swan accreditation is a key action in the University and EDI strategic plans. It is an eligibility criterion for the University to apply for research funding to SFI and IRC. Reporting of the intersection of gender and ethnicity is a data requirement for Athena Swan institutional and school applications (Silver level). A large section of the survey is used to satisfy the data requirements of AS applications at both the school/unit and the institution levels. Section 48 (2) of the “Disability Act” 2005 requires public bodies to collect data on employees with disabilities on an annual basis. In accordance with subsection (7) of the Act, UCC is required to report to the NDA on the number of people with a disability employed during each preceding year.

 

Legal basis for processing under GDPR and Data Protection Acts

Article 6 (1) (a), which states that public bodies can process personal data, whereby the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Article 6 (1) (c), which states that public bodies can process personal data, whereby processing is necessary for compliance with a legal obligation to which the controller is subject. UCC is subject to obligations under the Irish Human Rights and Equality Act (2014) and the Higher Education Authority Act 2022 regarding equality assessment and monitoring. Article 6 (1) (e), which states that public bodies can process personal data for the performance of a task carried out in the public interest or in the exercise of official authority. Article 9 (2) (a), which states that public bodies can process special categories of personal data where the data subject has given explicit consent to the processing of that personal data for one or more specified purposes. Article 9(2)(g), which states that public bodies can process special categories of personal data where necessary for reasons of substantial public interest, based on Union or Member State law. Sections 42 and 54 of the Data Protection Act 2018, which relate to the processing of personal data and special category personal data for statistical purposes. Please note that the submission of your personal data is voluntary. Any data you choose to submit via the 2026 “Values and Culture” EDI Staff Survey, as well as during the EDI Gathering events (2026, 2027), and AS focus groups (2026-2028), will be deemed to have been processed with your explicit and informed consent. Please note that consent may only be withdrawn up to the point at which the data has been collated with that of other participants for the purpose of producing statistics/a report, or within 10 working days after the submission of your survey responses, or after participating in the EDI Gathering events, and up to two working days after participating in AS focus groups. In processing collated information, we rely on those additional legal bases cited above.

Details of third parties with whom we share personal data

We will only share your data with third parties where necessary for the processing purposes outlined in this Privacy Statement. In accordance with Article 28 GDPR, when we share your data with third parties, we will ensure that the data is processed in accordance with specific instructions and that the same standards of confidentiality and security are maintained.

Data access

Internal:

Access to your personal data, provided via the various stages of the EDI consultation, is as follows:

i) 2026 “Values and Culture” EDI Staff Survey

• Only EDI Unit staff will have access to the data, on an “as needed” basis, to work on this study. The EDI Data Analyst (or the nominee) will have access to raw survey data for data validation and analysis, and the Director of EDI will have access for oversight.
• Data will be collected using the UCC ITS approved online Qualtrics survey tool
• Data will be collected anonymously by design i.e., no direct identifiers such as names, email addresses, or IP addresses will be collected.
• Raw data (i.e. survey responses) will be stored on Qualtrics until analyses are completed. Qualtrics analytics and reporting functions are used to produce tailored reports.
• Raw data sets will only be accessible in a highly protected environment (i.e. password-protected files on password-protected computers). 

No effort will ever be made to single out a set of individual responses – all raw data are aggregated, redacted and reported anonymously by default. It is acknowledged that certain data fields collected (such as School/Unit name, job role, and special category data such as ethnicity and disability status) could potentially lead to the identification of participants. However, no data will be reported in a way that allows the identification of an individual (s).  

ii) 2026, 2027 EDI Gathering – as above

iii) Athena Swan School-level focus groups (between 2026-2028, inclusive) – Athena Swan Project Officer will be the main facilitator and data processor for this part of the consultation. In the event of external facilitation, there are safety measures (approved by the UCC’s Social Research Ethics Committee) in place that will govern data processing.

External:

i) 2026 “Values and Culture” EDI Staff Survey

Figure 1. EDI ‘Values and Culture’ Staff Survey – Steps in Data Processing 

• Data reports will not compromise the anonymity of individual staff members (e.g. open-text survey responses may quote characteristics such as “male researcher” but without risking identification). 
• Where response rates from cohorts are very low (e.g. people who are in a minority in terms of their ethnicity), we will aggregate or further anonymise their responses, or not report specific data, as necessary to avoid identifying them in the survey report.
• Data from a group of fewer than five individuals or fewer than seven when special categories of data (such as, e.g., caring responsibilities) are involved will be either omitted or aggregated. NOTE: Some schools/units may use these data points if they determine there is no risk to respondents. This is to maximise the chances of the collected data being utilised as intended, i.e., to guide the self-assessment teams in their evaluation of, e.g., culture and working life.
• Figure 1 outlines the steps in data processing and details of third parties with whom we will share high-level, anonymised data reports.
• For the Athena Swan accreditation, the institutional survey data is disaggregated by the given applicant (School/Unit) records. Data is further anonymised to accommodate much smaller sample sizes (e.g., all demographic information is redacted except gender and caring responsibilities/family status).

ii) 2026, 2027 EDI Gathering and iii) Athena Swan School-level focus groups (between 2026-2028, inclusive)

• We will first identify data gaps to explore in more detail and then invite staff to participate in the EDI Gathering events and focus groups via email. This might mean that, for example, only female academic staff, only male researchers, or only administration staff of all genders will be invited to specific groups.
• EDI Gathering data will be used either to augment the understanding of the survey data, and by extension to:

1. Facilitate understandingof our staff experiences, needs, opportunities and challenges. 
2. Allow for developing evidence-based, tailored interventions and policies that avoid ‘one-size-fits-all’ solutions.
3. Assist with school/unit-level applications for the Athena Swan accreditation.
4. Track and evidence progress of strategic action plans.
5. Meet mandatory data returns to the National Disability Authority (NDA), Higher Education Authority (HEA), and the Department of Education (DFHERIS).
6. Undertake needs assessment as part of our Public Sector Duty commitments under the Irish Human Rights and Equality Commission Act 2014. 

• Athena Swan focus groups data will provide the necessary qualitative component of the data collection to facilitate the applicants.

Cross-border data transfers

Data will not be transferred or flow outside of the European Economic Area. The ESS Diversity Tool data is securely stored in the Data Lake Cloud.

How long will we keep your data

In keeping with the data protection principles, we will only store your data for as long as is necessary. For the purposes described here, we will store your data in accordance with the University’s Records Management Policy.

See Staff Data Protection Notice for more information on how the University collects and processes your personal data.

Your rights

You have various rights under data protection law, subject to certain exemptions, in connection with our processing of your data, including the right:

• To find out if we use your data, access your data and receive copies of your
• To have inaccurate/incomplete information corrected and
• In certain circumstances, to have your details deleted from systems that we use to process your personal data or have the use of your personal data restricted in specific ways.
• To object to the specific processing of your data by
• To exercise your right to data portability where applicable (i.e. obtain a copy of your personal data in a commonly used electronic form).
• Where we have relied upon consent as a lawful basis for processing, you can withdraw your consent to the processing at any time. Please note that consent may only be withdrawn up to the point at which the data has been collated with that of other participants for the purpose of producing statistics/a report.
• Not to be subject to solely automated
• To request that we stop sending you direct marketing

If you wish to avail of these rights, please write to: The Information Compliance Office, University College Cork at gdpr@ucc.ie.

Questions and complaints

If you have any queries concerning the ESS Diversity Tool, please contact a member of the ESS Diversity Tool Project Team: Dr Avril Hutch at AHutch@ucc.ie and/or Katarzyna Pyrz at kpyrz@ucc.ie.

If you have any queries or complaints in connection with our processing of your personal data, you can contact UCC’s Information Compliance Office by email at: gdpr@ucc.ie

You also have the right to complain to the Data Protection Commission if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the Data Protection Commission’s website (www.dataprotection.ie) or by telephoning 1890 252 231.

Definitions

Personal data:

Any information relating to an identified or identifiable natural person (‘data subject’).

Special Categories of Personal Data (Sensitive personal data):

• Data concerning health.
• Personal data revealing racial origin, ethnic origin, political opinions, religious beliefs, philosophical beliefs, trade-union membership.
• The processing of genetic data for identifying a natural person.
• The processing of biometric data for uniquely identifying a natural person.
• Data concerning a natural person's sex life or sexual orientation.

Processing:

Any operation or set of operations performed on personal data. Processing includes storing, collecting, retrieving, using, combining, erasing and destroying personal data, and can involve automated or manual operations.

Data subject:

Someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data controller:

An organisation, such as University College Cork, which determines the purposes and means of processing personal data.

Data processor:

A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller, typically under contract. This does not include Service staff who are processing personal data on behalf of the University as part of their employment duties.