Student Privacy Notice

This notice was last updated on 5th March 2026.

The University of South Wales is the controller and the University’s Data Protection Officer can be contacted through [email protected] The University is committed to protecting the rights of students in line with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

Certain areas within the University have privacy notices in place relating to their collection and use of personal data – this would include, but is not limited to; the Sport Centre, Accommodation Services and AZO. Where this is the case, the privacy notice will be available at the point of collection.

What information do we collect?

The University collects information in relation to its students at various points through the student journey. Personal data is collected at the application stage, at enrolment and throughout the period of study to form the student record.

Type of personal data processed includes, though is not limited to, the following:

Details of courses, modules, timetables and room bookings, assessment marks and examinations.
Financial and personal information collected for the purposes of administering: student funding, fees and charges, equipment loans, financial support schemes (scholarships, bursaries and hardship funds).
Photographs, and video recordings for the purpose of recording lectures, student assessment and examinations.
Information about an individual’s engagement with the University such as attendance data, use of electronic services such as UniLearn (Blackboard), UniLife, library,Panopto, Office 365 and other University systems.
When participating in an online lecture a recording of an individual’s image and voice may be captured.
Contact details for a next of kin, trusted contact or emergency contact to be used in an emergency/where there are serious concerns regarding wellbeing (The University requires students to inform the next of kin or trusted contact on the use of their data prior to providing the University with their data).
Details of those with looked after status or those who have left the care system - for the provision of support.
Information related to the prevention and detection of crime and the safety and security of staff and students, including, but not limited to, CCTV recording, body worn video recordings and data relating to breaches of University regulations.
Information relating to disciplinary or conduct issues.
Information gathered for the purposes of equal opportunities monitoring.
Information relating to the provision of advice, support and welfare, such as data relating to the use of the services offered by the Student Services, Learning Services, Advice Zones, including our Report and Support platform, Safe-zone, Hi-House peer-led drug and alcohol support service, the University Mental Health Pathway and the Student Bursary support
Information about an individual’s use of our information and communication systems including IP address, log in details, network access, browser type and operating system.
Attendance and engagement information.
Information on access to rooms and buildings when the student ID card is used to open a locked room.
Information processed via the Data Loss Prevention tools installed on our IT System.
For international students: Copies of passports, visas, information collected in relation to attendance and any other documents required to ensure compliance with Home Office requirements including an assessment of English language skills
For students on certain courses such as healthcare, teaching and social worker courses, records relating to suitability checks including DBS.
Information collected for administration of trips, visits and events.
Records relating to an individual’s studies at the University or at another institution or partner when a placement is undertaken away from the University.
The University collects information on Welsh language skills for the purpose of Welsh medium provision.
Information relating to careers advice and work experience.
For certain courses, such as nursing the University collects attendance records and timesheets.
Information relating to criminal proceedings and outcomes
Any other purpose we inform you about separately

Students studying at partner institutions in the UK or overseas, will usually enrol at the University of South Wales and at the partner institution. The partner institution will deliver the course and maintain a student record. The University, as the awarding body, will also keep some records as outlined in this privacy notice.

What information does the University receive from third parties?

The University works closely with third parties (including funding and sponsorship partners, educational institutions, examination boards, overseas agents, UCAS and clearing houses, business partners and compliance services such as UKVI and the Disclosure and Barring Service) and may receive information about individuals from them relating to their specialist areas.

How is data used and what legal basis is relied upon?

When students enrol the University will be required to collect, store, use and otherwise process data for any purposes connected with their studies, health and safety and for other reasons deemed necessary for the performance of the contract with the University or for the University’s public task in the public interest. The University will also use personal data for certain limited purposes after graduation.

The University will use personal data fairly and lawfully in accordance with its obligations under the Data Protection Act 2018 and UK GDPR and other associated legislation This means that data will be processed in a way which respects the data protection principles and the individual rights.

Although it is not possible to explicitly state every purpose for which personal information will be used, the following are examples of how it is likely to be used together with the relevant legal basis relied upon (see * below for information on the relevant article).

In order to enrol the student on the course, for course administration and to record academic achievement (for example – course choices, examinations and assessments) 6(1)(b), 6(1)(e)
To assist in pastoral and welfare needs (e.g. the counselling service and services to students with disabilities) 6(1)(a), 6(1)(d), 9(2)(a), 9(2)(c), 9(2)(g).
To carry out investigations in accordance with academic and misconduct regulations 6(1)(b), 9(2)(g).
To operate security, disciplinary, complaint and quality assurance processes.6(1)(b) 6(1)(e) 6(1)(f), 9(2)(b)(g)
To administer the financial aspects of student registration (such as payment of fees and debt collection) 6(1)(b), 6(1)(e).
To fulfil any legal requirements, for example those conferred upon the University under the Prevent Strategy 6(1)(c), 6(1)(e), 9(2)(g).
To administer support for employability needs 6(1)(e).
Where eligible, to support and enable individuals to gain work experience 6(1)(a),9(2)(a)
To provide or offer facilities and services to students (e.g. library access, printing, computing, sports facilities, accommodation, equipment loans) 6(1)(b) 6(1)(e).
To manage our estate, ensure health, safety and security of staff, security of our systems, students and visitors on campus 6(1)(f) 6(1)(d), 9(2)(c) and 9(2)(g).
For insurance purposes e.g. where the University arranges provision for field trips or where claims are made 6(1)(b), 9(2)(f)
To ensure the health and safety of students whilst registered at the University and to assess fitness to study, travel, take part in placements, provide appropriate reasonable adjustments and where requested, to make decisions relating to applications for mitigating circumstances 6(1)(e), 9(2)(g)
For certain courses of study, placements and work opportunities individuals will be required to undertake a DBS check ), 6(1)(b), 6(1)(d), 9(2)(c), 9(2)(g).
To produce management statistics/reports, to conduct research into its work, the effectiveness of University programmes of study as well as produce statistics for statutory purposes 6(1)(c) 6(1)(f), 9(2)(j) 9(2)(g)
In order to provide overseas students with support and advice on a range of issues such as immigration, cultural issues and welfare 6(1)(b). 9(2)(g)
For Higher Education Statistics Agency (HESA) purposes, the University is required to send information collected in respect of students to HESA statistical and analysis . 6(1)(c), 9(2)(j)
To enable HESA or another Higher Education Body (and/ or a third party under contract) to conduct the Graduate Outcomes Survey or another post-graduate survey following graduation 6(1)(f)).
Following graduation, personal data is processed by the Alumni Relations Development Team within the University as all individuals graduating automatically become members of the University’s Alumni Community. Full details on the use of personal data is available on the Alumni webpages 6(1)(f)
To monitor engagement of students on Tier 4 Visas to ensure compliance with the terms of their sponsorship 6(1)(c).
To monitor the University’s responsibilities under equal opportunity policies 6(1)(e), 9(2)(g).
To maximise an individual’s opportunities to succeed through the use of learning analytics. The University records behaviour and interactions with the University’s systems which are used as an indicator of engagement and progress. This information is analysed and used to help course teams identify students who may be at risk of withdrawing from their study. It is also used to indicate to the University that a student’s course engagement may have fallen below expectations, so that the lack of engagement process can be initiated. 6(1)(e) 9(2)(g)
Data provided at enrolment (such as educational attainment prior to study at USW, address, age), information on course progression and information on behaviour and interaction is kept for future analysis and research to aid our understanding of the student population and in learning analytics. Further information is available within the ‘Learning Analytics Student Guide’ and the ‘Student Engagement Monitoring Guide’ 6(1)(b) and 6 (1)(e) 6(1)(f).
This processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The University would also like to use information around ethnicity of the student population which would further enrich its datasets and enable the University to improve analysis based on a more individual level in the future. The University will only process this information with the individual’s consent.
To conduct surveys at various stages of the student lifecycle to gather feedback on the student experience in order that the University can review its provision 6(1)(f).
To enable students to participate in Student Union activities and to access support services provided by the SU 6(1)(f).
To film and record certain lectures. Please note that students are not the subject of these recordings but audio and video images may be captured. Students will be able to take measures to avoid this capture should they wish to do so, as outlined in the lecture recording privacy notice. 6(1)(b) 6(1)(e) 6(1)(f).
The University provides students with a ‘smart’ photographic identification card. The card can be used to access certain rooms, for security as a means to identify who is permitted on campus, to access the library and to allow access to print services. 6(1)(b).
For electoral roll purposes. Your name, date of birth, postal and email address may be provided to the relevant Local Authority. This is compulsory by law as legislated in Regulation 23 of the Representation of the People Regulations 2001. The University is legally required to disclose this information 6(1)(c).
Upon graduation the names of those graduating are published in the award brochure.
To facilitate prize draws giveaways or other incentives for projects or surveys 6 (1)(f).

Where students do not wish for their names to be included they may inform the Exams, Certification & Graduation Unit of this when they receive their invitation 6(1)(b), 6(1)(e).

To provide information relating to further learning opportunities at the University

6(1)(a) 6(1)(f).

Personal data on certain courses may be provided to organisations providing access to specialist software/resources that will support and enable students to undertake their studies 6(1)(b).

* GDPR Article 6 legal basis

6(1)(a) The data subject has given consent to the processing.

6(1)(b) The processing is necessary for the performance of a contract.

6(1)(c) The processing is necessary for the compliance with a legal obligation. 6(1)(d) The proessing is necessary to protect the vital interests of the data subject or of another person.

6(1)(e) The processing is necessary for the performance of a task carried out in the public interest.

6(1)(f) The processing is necessary for the purposes of the legitimate interests pursued

How does the University process Special Category Data?

The University will also process ‘special category’ personal data. Special category personal data is defined as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health - including mental health and disability information ,or sex life and sexual orientation, genetic data and biometric data which is processed to uniquely identify a person.

Special category personal data will only be processed in certain situations in accordance with the law.

With the individual’s explicit consent – Article 9(2)(a), (e.g. Pastoral support, disclosure to external support services , use of special category data within learning analytics).
Where it is necessary to protect the individual’s vital interests or those of another person and where they are physically or legally incapable of giving consent– Article 9(2)(c). This would be in an emergency situation where the health, wellbeing or welfare of the individual was at risk
Where the data subject has made the information public – Article 9(2)(e).
Where the processing is necessary for reasons of substantial public interest – Article 9(2)(g) (e.g. welfare support for the purposes of safeguarding, to comply with the Prevent Duty, for equal opportunity monitoring,
Where processing is necessary for archiving purposes in the public interest, scientific or historical research purpose or statistical purposes. – Article 9(2)(j) (e.g. University research and the production of management statistics)
Where processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services - Article 9(2)(h) (e.g. )referral to external bodies for the provision of health care).
Individuals on certain courses will be asked to provide details of criminal convictions and undertake a DBS check when they are offered a place on a course which leads to employment in a regulated profession and the course involves an integral work placement which could not be undertaken if the student had a criminal conviction. Students enrolled on other courses will also be given the opportunity to tell the University about any criminal convictions. This information is gathered for the purposes of providing support and conducting risk assessments. Article (6)(1)(f), (9)(2)(g)

Who receives this data?

Where necessary personal information will be shared internally within the faculties and departments across the University. Personal data is protected by the University and information will not be disclosed to third parties unless it is necessary for a purpose s permitted by law. This section outlines the major organisations and the most common circumstances in which we disclose data about students. Where this involves international transfer of your data, data will only be transferred if it meets the conditions and safeguards set down under current data protection legislation.

After graduation the University will need to maintain some records in order that it can verify awards, provide transcripts of marks, to provide academic references and for career support.
The University will share personal data with the Students’ Union in order to allow students to participate in the election of its officers and to become a member of the Union. Where appropriate personal data will be shared with the Students’ Union for purposes relating to conduct/to support investigations.
Following graduation, personal data is processed by the Alumni Relations Development Team within the University as all individuals graduating automatically become members of the University’s Alumni Community. Full details on the use of personal data is available through the Alumni webpages.
The University is an Approved Education Provider for the purposes of the PointsBased Immigration System. The University will provide data about students on the Tier 4 Student Visa and other categories of visa to the Home Office and its departments in order to fulfil its duties as a Tier 4 Sponsor Licence holder.
Sponsors and parents or representative where the appropriate consent has been provided or another legal basis is identified.
HE/FE institutions & placement providers: Where students are involved in study arrangements with other organisations, e.g. exchanges, placements, joint/double programmes, we may disclose some data to the relevant institution, including those outside the UK.
Relevant Higher Education bodies such as the Office for Students, UK Research and Innovation, UCAS, the Office of the Independent Adjudicator and the NSS
The Student Loan Company: Personal data will be shared to confirm enrolment, attendance and identity in order that students can access financial support.
Debt recovery / credit control: Personal data may be shared with third parties, attempting to recover debt on behalf of the University, where internal debt recovery procedures have been unsuccessful.
Potential employers or providers of education approached by the individual for references/confirmation of award.
UK agencies with duties relating to the prevention and detection of crime, collection of a tax or duty (including Income or Council Tax) or safeguarding national security (when there is a basis to disclose).
The University has a statutory obligation to release information to the Higher Education Statistics Agency (HESA) for statistical analysis. Full details on the uses of student data by HESA can be found at http://www.hesa.ac.uk/fpn.
The University is required to pass data about its students to the Commission for Tertiary Education and Research (Medr) for them to conduct the National Student Survey. This provides students with the opportunity to give their feedback on their experiences at the University. Information will also be provided to Medr in line with our statutory responsibilities.
Personal data relating to students on specific programmes will be passed to professional bodies which accredit those programmes at the University in connection with registration such as Law Society, General Chiropractic Council, Care Council for Wales. If there has been an incident of academic or professional misconduct and/or where the Head of School or equivalent believes there is a concern related to fitness to practise which may result in a risk to the public, this will also be reported to the appropriate professional body.
Personal information may be shared with work placement providers including contact details, information around the individual’s studies and other necessary information which may be relevant to the placement
In line with our statutory obligations personal data is shared with organisations such as the Commission for Tertiary Education (Medr) the Education and Skills Funding Agency.
Following graduation the University, HESA or other Higher Education Body may contact individuals to ask them to complete one or more surveys into the outcomes of higher education and details of activities or experience after graduation. These surveys may be undertaken by the University, another Higher Education body or by another specialist organisation contracted for that purpose. The University may share student contact details with another Higher Education Body or a third party contracted for this purpose. If a specialist organisation is used that organisation will receive the individual’s contact details, but will only use these details to ask individuals to complete the survey, these details will then be deleted. Individuals may also be contacted as part of an audit to check that the University or any contracted organisation have undertaken these surveys properly (full details on the HESA collection notice are available here)
The University may share basic student details with external consultants for the purposes of conducting surveys to evaluate and enhance the student experience.
Coursework and assignments are submitted through Turnitin® UK, which supports academic staff in identifying any plagiarism, re-presentation and inappropriate citation. Where plagiarism is suspected, work and information may be shared internally and with other institutions as required.
Data may be shared with partner colleges where the University has partnership arrangements in place for purposes relating to their studies and for administrative purposes.
Data may be shared with partner organisations for the purposes of supporting individuals susceptible to being drawn into or supporting violent extremist or terrorist ideologies.
Data may be shared with partner institutions for administrative and support purposes.
Personal information may be shared with organisations (including other education providers) with whom we work collaboratively and with other agencies (including the Welsh Government) where there is a requirement on the University to report on outcomes, progression or for equality monitoring purposes.
Relevant information will be shared with third party providers of accommodation where arrangements are in place for the sharing of data in respect of certain matters such as those involving the contract, wellbeing or safeguarding.
The University’s internal online directory will include a name and email address for each student.
Relevant information such as name, email address and content of communication may be shared with third party suppliers providing, customer engagement platforms and customer relationship management systems that we use for sending correspondence.
In the event of an emergency or a serious concern for an individual’s wellbeing or the safety of others the University may contact third parties such as next of kin, trusted contact or the emergency services.
Companies or organisations providing specific services, to or on behalf of, the University under contract as a data processor.
Any other recipient we inform you about
The University may disclose information if it is necessary for criminal, legal, or regulatory proceedings, or any other purposes permitted by Schedule 1 of the Data Protection Act.
Any other disclosures that the University makes will be in accordance with data protection legislation and having taken into consideration the interests of individuals.

How long will data be held?

Personal data will be kept in line with our Records Retention Schedule or for any other period that we inform you of.

Individual rights

Individuals have the right to access personal information, to object to the processing of their personal data, to rectify, to erase, to restrict and to port personal information.

Any requests or objections should be made in writing to the Data Protection Officer – [email protected]

Where individuals are not satisfied with the University’s response, or believe that the University is not processing personal data in accordance with the law then they may complain to the Data Protection Officer.

If the matter is not resolved and the individual remains dissatisfied then they have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF