Internet Explorer is no longer supported by Microsoft. To browse the NIHR site please use a modern, secure browser like Google Chrome, Mozilla Firefox, or Microsoft Edge.

REALMS General Data Protection Privacy Notice - May 2018


Published: 07 August 2019

Version: 1

Print this document

Information you need to know

We are part of the NIHR which is funded through the Department of Health and Social Care (DHSC) to improve the health and wealth of the nation through research. NIHR does this through a number of contracting agents who advise on, recommend, organise and administer the commissioning of research programmes, infrastructure, training and patient and public involvement. The contracting agent for NIHR is the University of Southampton. For the purposes of Data Protection the University is the Processor.

The University processes data on behalf of the Department of Health and Social Care (DHSC). They are the Controller.

The Data Protection Officer for your data is:

John Ryder

Department of Health and Social Care

39 Victoria Street



This privacy notice explains how we use your personal information and your rights regarding that information.

You can read the DHSC’s privacy policy for the NIHR here.

Why are we collecting your data?

We use the information you give for purposes associated with the application and award processes for research funding.

What do we do with your data?

What we do with your data depends on why you are giving us your information (the role you are performing). Sometimes you may carry out more than one function within the research management pathway (for example, you may be both an applicant and a reviewer). Please read all the information that applies to you.

If you are an applicant

We will use your data in relation to:

  • The registration of your application
  • The operation of grants processing and management information systems
  • The acquisition of UK and/or international peer reviewer comments on proposals and reports
  • The preparation of material for use by reviewers, experts, referees and review panels
  • Your response to reviewer comments
  • Payments made to your Higher Education institution
  • Statistical analysis in relation to the evaluation of research (research on research)
  • Publication of identifiable information about lead investigators and personal award holders.

We also collect sensitive data relating to equality and diversity (such as ethnicity). This information is collected separately through a dedicated Equality and Diversity Reporting System and stored separately and encrypted to maintain anonymity.

If you are a reviewer

We will use your data for:

  • Your review of proposals and reports
  • Email alerts and bulletins
  • A list of reviewers is published annually on the NIHR website

Reviewer identity is not disclosed to applicants; anonymous external reviews are returned to applicants.

If you are a board or panel member

We will use your data in relation to:

  • Your assessment of outline and full proposals
  • Funding recommendations
  • Compiling a Register of Interests in order to manage a potential conflict of interests.

If you are a Public and Patient Involvement (PPI) representative

We will use your data as stated above, depending on which role you fulfil. In addition, and in the course of the performance of your role, you may give us sensitive data such as medical information. We will ask you for your consent to our processing this information separately from this notice before we undertake any processing of your sensitive personal data.

What is the legal basis for processing the data?

We process your data in order to perform a task in the public interest (the ‘public task’ ground).

Who we share your information with

If you are an applicant we will share your information with other DHSC/NIHR bodies and with other approved research funding organisations outside NIHR in order to coordinate research activity in the UK.

Transfer to a third country

In order to ensure that our systems are operating effectively it may on occasion be necessary to transfer your information outside the European Economic Area to a company in the United States which is registered with the Privacy Shield scheme. This is for the purposes of testing and development of the system.

How long we process your information for

For information about how long we keep your information for please see the DHSC NIHR Privacy Policy

Maintenance of your data (accuracy)

We ask you to maintain and update your information (including contact details).

How can I access the information you hold about me?

You should write or email the Data Protection Officer at the address above, or you can email using the address

What are my rights? And how do I enforce them?

You have the following rights:

  • Right to be informed
  • Right to object to Direct Marketing
  • Right of Access
  • Right to restrict processing
  • Right to rectification
  • Rights related to automatic decision making

You should contact

How do I complain to the Information Commissioner’s Office?

The Information Commissioner can be contacted:

By post

Information Commissioner's Office

Wycliffe House

Water Lane




By telephone


By email

Via the ICO website.