Data Protection

The General Data Protection Regulation (GDPR) comes into force on 25 May 2018 and will replace the UK's Data Protection Act, 1998.

The Union is currently in the process of preparing for GDPR implementation and will use this site to publish guidance, procedure and policy to assist colleagues in GDPR preparations.

In addition, the UK will be subject to a separate Data Protection Bill that will legislate on areas outside of the GDPR as well as those aspects of the Regulation where member states are required to implement their own law. 

The Data Protection Bill has just been passed and will come into force on 25 May 2018



The University of York Students' Union is a registered data controller under the terms of the Data Protection Act. Its registration number is ZA270378.

The Union's registration and notification of its uses of personal data can be viewed as part of the Public Register of Data Controllers maintained by the Information Commissioner's Office.



Cate Tracey, Data Protection Officer & Directory of Finance & Resources.

For further information, contact


Documents, Forms & Links