Protected access
Personal data in modern archives
A lot of modern archive material contains sensitive material or personal data. Such material is subject to the General Data Protection Regulation (GDPR) and Data Protection Act 2018.
Some material will not be available at all. Other material will be available in part, or subject to certain protections. Only a limited amount of information may be available in the catalogue, and the contents may need to be reviewed by an archivist to check if it can be made available.
Assessment of material
Modern archival material is assessed to judge whether it can legally be made available to researchers.
When material is closed, a date for review is agreed and published in the catalogue.
When material is protected but not completely closed, researchers should fill in an application for access to protected material (DOCX) and state the nature of their research before the material can be made available.
Completed forms should be sent to the Special Collections email address.
An application for access to protected material may require further review before we can make a decision. This may take some time, depending on the size and nature of the material. Please don’t expect to access protected material on the day it is requested.
Access to particularly sensitive may need to be discussed with the Head of Special Collections and will depend upon the purpose of use.
Your responsibilities as a researcher
As a researcher, you are responsible for any personal data concerning living individuals that you take away from Special Collections (including any notes, digital images and/or photocopies). You become a "data controller" of the personal data held about the individual/s (the "data subject/s").
As a data controller you have certain responsibilities:
- You must not cause substantial damage or distress to data subjects.
- You must not use data to support measures or decisions concerning individuals.
- You must anonymise identities whenever possible when note-taking, in results of research and statistics.
- You must respect the confidentiality of any documents and information not connected with your research but which you have seen in the course of it.
In deciding whether it is appropriate to use or publish personal information consider:
- Is the person alive?
- Is the information already published or in the public domain?
- Is the individual a public figure?
- Does the information belong to a sensitive category of information as defined by the Data Protection Act?
- Could the context of the information disclose data about an individual by default?
You can find out more about GDPR and the Data Protection Act on the Information Commissioner's website.