Student regulations privacy notice
The University holds and processes personal data about current and former staff, current and former students and third parties. This could include personal sensitive information (for example, relating to health matters).
The personal data held about you consists of your:
- Contact details
- Name
- Student number
- Photo images
- Health information
- Academic records
- Any other information relevant to the processing of your specific case under the student facing regulations.
Only the data required to fairly and thoroughly process your case is collected and the data collected is kept up to date whilst your case remains open.
The University may receive this data:
- Directly from you when you make a submission under the student facing regulations, such as an academic appeal
- From other departments within the University when your case is processed or initiated. A list of the main departments consulted are:
- All teams within the Chief Student Officer Directorate
- Library and Learning Centre
- Accommodation Services
- Academic staff (including Personal Tutors, Supervisors, Programme Leaders, etc.)
- Security Services
- Records held by faculties and/or the Doctoral College
- IT Services
- The Vice Chancellor’s Office
- Recruitment and Admissions.
- The University may also collect information relating to you from:
- Other internal sources, such as SurreyLearn and MySurrey Engagement
- Publicly available sources, such as social media
- Other organisations concerned with your health and wellbeing
- Organisations providing placements
- The Students’ Union on misconduct matters and the completion of any disciplinary workshops.
The list above is not exhaustive. If you require any further detail you should contact the Office for Student Complaints Appeals and Regulation (OSCAR) in the first instance.
The University processes and shares personal data and special category data in the substantial public interest and only where it is necessary to enable the University to fulfil its duties of care to the student, other students, or to safeguard third parties.
The University reviews and collates information that you have provided to the University in order to process your case. Information about you from other university departments, publicly available sources and other organisations is only collated when it is relevant to the processing of your case.
Information collated in relation to your case may be shared in order to initiate other student-facing regulations, for example the regulations for support to study.
Your personal data is kept in accordance with the University’s retention schedules. This means that data collected and stored as part of the student facing processes is kept for 15 months after the date that you are no longer a registered student at the University, or 15 months after the case is closed (whichever is the latter). The information is then destroyed.
It may be necessary to share your personal data with the following university departments in order to process your case:
- Accommodation Services
- Academic staff (including Personal Tutors, Supervisors, Programme Leaders, etc.)
- All teams within the Chief Student Officer Directorate
- Doctoral College and/or faculty
- IT Services
- Library and Learning Centre
- Office for Student Complaints Appeals and Regulations (OSCAR)
- Recruitment and Admissions
- Secretariat and Legal Department
- Security Services
- The Vice Chancellor’s Office.
It may also be necessary to share your personal data with the University of Surrey Students’ Union in order to process your case. You should contact the USSU directly for a copy of their privacy notice.
As part of routine authenticity checks the University may also share copies of documentation that you have provided with the authors. This is conducted in order to verify that the documentation is genuine.
The list above is not exhaustive. If you require any further detail you should contact the Office for Student Complaints Appeals and Regulation (OSCAR) in the first instance.
By submitting personal data about third parties you are confirming that the third party is aware and understands why their personal data has been provided to the University and how it will be processed.
As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.
You have the right to:
- Withdraw your consent for us to process your academic appeal and we will destroy information collated in relation to your academic appeal 15 months after the date that you are no longer a registered student at the University or 15 months after the academic appeal is closed (whichever is the latter).
- Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
- Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete.
- Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the guide to data subject rights information.
- Restrict the processing of your personal data in certain ways.
- Obtain your personal data for reuse.
- Object to certain processing of your personal data
- Where you have initiated a process under the student facing regulations e.g. by submitting an academic appeal or formal complaint, you can withdraw your consent to process your case and the University will destroy information collated in relation to your case 15 months after the date that you are no longer a registered student at the University or 15 months after the appeal is closed (whichever is the latter). The University will keep the aggregate data which does not identify you within our datasets.
If you would like to exercise any of your rights please visit our make a privacy request section.
Details on university-wide measures surrounding IT security can be found in Our Data Policy Statement (PDF) (incorporating Information Security Policy).
Make a complaint
If you have any concerns about the way that we have handled your personal data please email the Data Protection team as we would like to have the opportunity to resolve your concerns.
If you’re still unhappy, you have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.