Legal Services


Student Privacy Notice

UCL General Student Privacy Notice. 12th February 2019, version 2.9

General Data Protection Regulation (GDPR): UCL General Student Privacy Notice

UCL ("we", "our", "us") are committed to protecting and respecting your privacy.

This privacy notice sets out how any personal data we collect from you through your electronic and/or paper application to UCL will be processed by us. This notice also sets out the basis on which any personal data related to your application which is passed to us by by individuals and by third parties is collected and processed. Please read the following carefully to understand how we process your personal data.

What is 'personal data'?

‘Personal data’ means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you.

This statement and UCL's data protection obligations

UCL will use the personal data you provide, as well as personal data for which you have given consent for UCL to receive (e.g. UCAS or SLC data) to process your application and enrolment.

In accordance with the Data Protection Act 2018 (the “DPA”) and the General Data Protection Regulation (the “GDPR”), and any data protection legislation enacted in the UK (the “Data Protection Legislation”) we are a data controller and this means that we are legally responsible for the personal data we collect and hold about you. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it. We also need to tell you about your rights in relation to your personal data. In addition to the information in this statement, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer, and in certain situations, you may be asked whether you give your consent to us processing information about you.

Information we may collect about you through your application and enrolment

In addition to the data you have provided in your application, we will collect and process the following information about you:

  • Fee status (e.g. home, EU or overseas),
  • Name,
  • Date of birth (age),
  • Proof of Identity (e.g. passport),
  • Contact info (address, phone, email etc),
  • Disability,
  • Ethnicity,
  • Nationality / place of birth/ domicile,
  • UKVI confirmation for acceptance to study / visa / biometric residence permits,
  • Academic Technology Approval Scheme,
  • Date of entry to the UK,
  • English proficiency,
  • Literacy/numeracy proficiency,
  • Overseas police check,
  • Student status (e.g. ‘offer’, ‘accepted’ etc),
  • Qualification information (provided by the applicant and external bodies e.g. UCAS),
  • Marks,
  • Awards,
  • Course,
  • Information about your career aspirations and work experience,
  • Programme fees/ payment info,
  • Student funding and finance information (including sponsor details),
  • Occupational Health,
  • Next of kin / guardian / family etc,
  • Reference / Referee data,
  • Statutory checks,
  • Five year address history,
  • Disqualification by association form,
  • Photograph,
  • Geodemographic information,
  • Low participation neighbourhood,
  • Parental higher education, and
  • Time in care.

Information we collect about you.  Both your image and voice may be recorded during our use of Lecturecast (our system for recording lectures and making them available online) as specified and at teaching locations across the UCL campus. In accordance with our CCTV Policy  we may also capture your image on CCTV whilst you are on UCL premises.

Information we receive from other sources

We work closely with third parties, including, for example:

  • funding and sponsorship partners;
  • educational institutions;
  • examination boards;
  • overseas agents;
  • UCAS, and clearing houses; and
  • business partners and compliance services e.g. UKVI, Disclosure and Barring Service and may receive information about you from them if you have provided specific consent to this sharing of your personal data in your agreements with those third parties.

If you have provided such consent, we may receive any of the following information from third parties:

  • examination or test results;
  • evidence of sponsorship (e.g. scholarship, bursary, loan);
  • updates on your CAS status; and
  • DBS certificate number and other information in connection with your UCL activities. 
Purposes for which we process your personal data

We process information we hold about you for the following purposes:

Information you give to us. We will use this information:

  • To process your application to study at UCL
  • To create a student application record
  • To form a decision about your application with a view to accepting or rejecting your application
  • To administer the financial aspects of your relationship with us and any funders/sponsors
  • To enable effective communications with you
  • To produce statistics and research for internal and statutory reporting purposes
  • To monitor our responsibilities under equalities legislation with a view to enabling such equality to be promoted or maintained
  • To facilitate your education, record the details of your previous academic studies (including any placements with external organisations) and determine your examination achievements
  • To manage your use of facilities and participation at events (e.g. computing, libraries, accommodation, functions, graduation, careers)
  • To enable effective communications with you
  • To operate security, disciplinary, complaint, and quality assurance processes and arrangements
  • To support your training, health, safety and welfare requirements, including sharing necessary information with appropriate third parties such as your family or the police in circumstances where it is in your vital interests
  • To allow your achievements via the UCLU to be accredited, for example by inclusion in the Higher Education Achievement Repor
  • Before you graduate, the Office of the Vice Provost (Development) (OVPD) creates an outline record for you from the UCL Student database with name, department, preferred gender, date of birth, "UCL Person ID", Student Number and your UCL email address. This is to enable OVPD to run careers mentoring registration and record touchpoints.
  • Following your graduation, your personal data will be used by the OVPD to keep you in touch with UCL and the Alumni Network, and a snapshot of your data may also be used for training purposes.  Further details about how OVPD may use your information can be viewed in the separate OVPD data protection statement 
  • To verify your enrolment, attendance, progression and award to third parties where it is lawful to do so (eg with your consent)
  • Any of the core purposes and ancillary activities linked to furthering UCL's core purposes that are described in our ‘Statement of Tasks in the Public Interests’

Information we collect about you. We will use this information for the following purposes:

  • to support your academic studies, and those of other students.
  • as part of our efforts to keep our campus safe and secure;

Information we receive from other sources

We will combine this information with information you give to us in your application and the information we collect about you. We will use this information and the combined information for the purposes set out above.

Special category personal data

We will process personal data about your physical or mental health or disability where you choose to provide these details to us in order to:

1. request reasonable adjustments relating to a disability - this could be, for example, to help with attendance at an open day or for an entrance tests, to administer accommodation requirements or to support your study at UCL;   
2. administer our extenuating circumstances procedures; and
3. process any occupational health assessment.  


We will use your special category personal data for certain courses of study. Personal data about past criminal convictions may be processed where there is a relevant need because you will be working with children or vulnerable adults, and/or because of fitness to practise requirements in certain regulated professions. Where these details are required you will be provided with further information about this. 


Using your information in accordance with data protection laws

Data Protection Laws require that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. We take our responsibilities under Data Protection Laws extremely seriously, including meeting these conditions. The legal bases on which your personal data are collected are explained below.

Consent:  We may ask you to provide us with special category or sensitive personal data as detailed above which we will agree only to process with your express consent.

Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you to provide UCL's services to you or because you have asked for something to be done so you can enter into such contract.

Public interest: The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;

Legitimate interests:  The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations of the University effectively.


Who is my personal information shared with?

As part of your application, your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes.  Disclosures may also be made by UCL as outlined below:

  • To UCLU to enable it to manage your student union membership by communicating with you.  UCLU will only use this information for running the Union, for example communications regarding your membership rights, including for example, notice of general meetings, referenda and election of trustees, as well as information about the Union's activities;
  • To sponsors, government agencies and present or potential employers. One such body is the Higher Education Statistics Agency (HESA); further information about the uses for which HESA processes personal data can be found on the HESA website;
  • Your contact details may also be passed to the Office for Students and its agents for the purpose of administering the national student survey, and to our agents for the purpose of administering our own surveys;
  • Where a programme of study leads to a qualification recognised by a professional body we will disclose relevant information to that body (e.g. General Medical Council);
  • Statements of student status will be provided on request to Council Tax Registration Officers;
  • To the Student Loans Company;
  • To debt collection agencies acting on our behalf in the event that you owe money to us;
  • Release of results to former schools/colleges;
  • If you decide to make on-line payments to us, limited information (date of birth and student numbers) will be disclosed to our service provider for validation purposes;
  • To the Office for Students (OfS);
  • To the Office of the Independent Adjudicator (OIA);
  • To providers of anti-plagiarism software;
  • Where you are on a programme of study that is jointly run or administered with other Higher Education Institutions or organisations that deliver teaching and learning, we will share your personal data with those organisations
  • Where you are studying at UCL via a reciprocal exchange / study abroad agreement, we will share your personal data with your home institution for the purposes set out above and in accordance with the terms and conditions of the applicable partnership agreement.

  • When you apply for accommodation while studying at UCL, your personal data may be disclosed to organisations in order to administer and provide for your accommodation

  • Your personal data will be shared with Prospects Hedd (Higher Education Degree Datacheck) to verify of your enrolment, attendance, progression and award to third parties where it is lawful to do so (eg with your consent)

  • suppliers and service providers

As a College of the University of London, we provide student personal data to the University for administration of examinations and for the award of degrees;

  • To NHS services in circumstances relating to your vital interests or with explicit consent;
  • If you undertake a placement or complete a period of study with a third party organisation or institution in the UK or in another country, personal data relating to you may be shared with the partner organisation/institution for the purposes of administering the placement.
  • Sensitive personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.
  • If you apply to attend a graduation ceremony your first name, initials, surname and degree title will be printed in the souvenir programme. It may also appear on some UCL merchandise. You must inform the Student Support and Events Team in writing before the ticket application deadline if you wish to opt out of this.
  • Your basic contact details will be made available through the UCL online directory service, unless you opt out of this. See 'How to become ex-directory' for details.

And if you are an Undergraduate Degree Student;

  • To GradIntel, the service through which the Higher Education Achievement Record will be delivered

If you do not complete your programme, to the organisers of the "Back on Course" scheme - the Open University and UCAS.

From the 2016/17 academic year, we, along with a consortium of other universities, are participating in a 'Learning Gain' project sponsored by HEFCE. Your level of work experience and self-evaluation about how prepared you are for your future career will be passed to HEFCE to allow them to conduct further research into learning gain, including combining with data from similar work at other Universities and Colleges. These data may be linked to other data that they hold about you including prior, current or future educational records and records on earnings and employment. These data will not be used in any way that will affect you personally and any analysis published will take steps to ensure that you cannot be identified from it. If you have any questions about the use of your data for this purpose please email HEFCE.

We will not disclose any other personal information about your application to other external enquirers or organisations without your consent unless it is in your vital interests to do so (e.g. in an emergency situation).

Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at UCL.

The information we process may be held on UCL Corporate systems some of which may be owned and operated by third parties.  Where we engage with such third parties, we insist upon strict contractual requirements to be adhered to by them to protect the personal data.

For further information on how we manage disclosures to parents and other third parties, including information about what disclosures we make in the case of emergencies, please see our guidance on Confidentiality



Personal Data shall be:

Lawfulness, fairness and transparency

be processed lawfully, fairly and in a transparent manner in relation to the data subject.

Purpose limitation

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

Data minimisation

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.


accurate and, where necessary, kept up to date.

Storage limitation

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Integrity and confidentiality

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures


be able to demonstrate compliance with the above principles


Data retention

Your data will be retained in accordance with UCL’s Records Retention Schedule. After you leave UCL certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study.

If you are not successful in your application or you reject the offer to study at UCL, the data which you have provided as part of your application will be retained in full according to UCL’s Records Retention Schedule. This is to ensure that UCL can meet its statutory reporting requirements as well as its own internal business analysis, as detailed above.

After this time, the personal information you have provided will be removed from your record, and the non-personal elements of the data which you have provided will be retained for further internal business analysis.

Your rights

Under certain circumstances, you may have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you (please see section entitled "How can I access my personal information" below).

Right 2: A right to require us to rectify any inaccurate personal data held by us about you.

Right 3: A right to require us to erase personal data held by us about you.  This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below).

Right 4: A right to restrict our processing of personal data held by us about you.  This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims.

Right 5: A right to receive personal data, which you have provided to us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you.

Right 7: A right to withdraw your consent, where we are relying on it to use your personal data.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop. 

Requesting information

As noted above, you have the right to access information held about you. Your right of access can be exercised at any time by contacting the Data Protection team.

Keeping personal data up-to-date

The Data Protection Laws require us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. Applicants and students are responsible for informing us of any changes to the personal data that they have supplied during the course of their application and enrolment. Enrolled students can update their details via Portico.

How can I access my personal data?

As noted above, you have the right to access information held about you. Details are set out on the University's Data Protection policy  Your right of access can be exercised at any time by contacting us or Data Protection Officer, UCL Gower Street, London WC1E 6BT. 

Changes to this Privacy Notice

Any changes we make to this privacy notice in the future will be posted on this page, myUCL and, where appropriate, notified to you by e-mail.

Who regulates the use of my personal information?

The University maintains a data protection registration with the Information Commissioner's Office, the independent authority which oversees compliance with the Data Protection Laws. The University's registration number is Z6364106 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. Please see the Information Commissioner's Office website for details.

Who do I contact with questions?

The data controller for the purposes of the Data Protection Legislation is University College London. If you have any questions about how your personal data is used, please consult the University's data protection webpages. UCL's Data Protection Policy can also be found on this website. If you need further assistance, please contact the University Data Protection Officer or Data Protection Officer, UCL Gower Street, London WC1E 6BT.