The University typically holds personal data on the following groups of data subjects:

• Staff, dependents, affiliates, job applicants
• Students, recruitment prospects, applicants for admission
• Graduates and alumni
• Donors, contributors, partners, and associates
• Prospective employers, external student mentors/advisors, activity contacts
• Vendors, service providers, contractors
• Associates of the University including court, council, and other notable members
• Contacts collected through various University activities (e.g. seminars, training, conferences, fund raising, other special events)
• Others (e.g. key government personnel with which the University has dealings)

A number of central departments/offices, by virtue of their designated responsibilities, deal extensively with the personal data in the above groupings and are logically the first-line users of the data that fall within their respective areas of responsibility (“Central Data Users”). Note that the bulk of personal data in the above categories are held in central databases and maintained/processed via central administrative system functions.

As Central Data Users, these offices/departments will:

• ensure that the personal data held in respective central database(s) are captured, processed, kept current, and retrieved in accordance with the principles of the Ordinance;
• review and scrutinize requests by other data users for the use of such central data;
• advise other data users regarding the proper handling of personal data entrusted/released for their use;
• keep track of data users who had been given standing access permissions to central data and to review such periodically;
• be one of the primary contact points to handle requests from data subjects regarding review/correction of the recorded personal data;

• advise other data users in relation to their dealings with agents that handle and use personal data;

• require other data users to periodically provide status updates on the personal data transferred to agents and confirm that the transfer, handling and use of the personal data is in all respects in compliance with the Personal Data (Privacy) Ordinance, the University Data Privacy Policy Statement and the Personal Information Collection Statement relating to the personal data, as well as the mandate stipulated by such other data users.

To accomplish the above, it is expected the Central Data Users will put in place a clear and systematic approval and tracking process for data requests and usage. In doing so, Central Data Users shall also ensure that they will not do anything that would be inconsistent with such directions and/or guidance as may be given by the Data Privacy Officer from time to time.

Below is the list of Central Data Users for the various groups of data subjects: