Student data privacy statement | University of Westminster, London

Personal data means any information relating to a person who could be directly or indirectly identified by that information. This definition provides for a wide range of ways that a person may be identified by their data. This includes their name, identification number, location data or an online identifier. Some information is considered to be ‘Special Category’ information and needs more protection because of its sensitivity.

The University of Westminster is the Data Controller for the personal information held in relation to students.

How we collect information

We collect information about you when you

become a student at the University of Westminster.
sign up to our services, activities or online content.
third party organisations (this can include UCAS, Student Loans Company, Government Departments such as the Home Office or Department of Education, other institutions involved in the delivery of joint programmes) share information about you with us.
when you disclose your personal data, as a student, during the course of your relationship with us when accessing or using any of our services such as financial support, careers advice or support services.

Confidentiality

Authorised personnel within University of Westminster will be able to access the personal data you provide to us. Access to and use of your personal information is limited in any specific circumstance to only those staff and administrators who need that access to manage and respond to your application, enrolment, studies and related processes and use of our services.

What information we collect and hold

Personal information collected includes:

your name, and contact information such as address (home and term time), email address (personal and University of Westminster) and telephone number, as well as your date of birth, country of domicile and your nationality.
your passport or national identity card details and where relevant your visa and immigration history.
information relating to your education and employment history, the school(s), sixth form college(s) and other colleges or universities you have attended and places where you have worked, the courses you have completed, dates of study and examination results.
records relating to assessments of your work, details of examinations taken, your predicted and actual marks and grades and other information in your student record.
details of your engagement with your course and the services we offer.
your national insurance number (or other tax identification number) and bank details if you want to work for us during your studies.
data about how you use websites or other university-related online content, and the device(s) you use to access these services.
your image or footage – for anyone taking part in university activities that they may be photographed, filmed, videoed or otherwise captured in image form.

Special category information collected includes:

information relating to racial or ethnic origin.
information relating to religious or philosophical beliefs.
information regarding health conditions or disabilities.
information relating to sexual orientation or sex life.
biometric information relating to your immigration and visa status for applicants who have a biometric residence permit.

How the personal information we hold is used

Your personal information will be used to:

enter into a contract of education with you or to perform our obligations under your contract of education.
facilitate and deliver your education or chosen course of study, record the details of your studies, register you and determine and record any course work, assignments and any examinations you undertake.
process applications, provide student support services, residential services, library services, and alumni services.
evaluate academic assessments and other course work (for more information please refer to the assessment privacy notice), and publication of academic awards.
to support you in studying at a partner institution, if you wish to do so via our student exchange and summer school programmes.
monitor student attendance at lessons, the submission of assessment and engagement with course material available on software tools.
facilitate and help deliver our careers advice and employability services.
provide support to all student via our student centre.
assess and provide student wellbeing support services including the provision of our Faith and Spirituality Service and disability, mental health and financial support services.
process safeguarding concerns to ensure the safety and wellbeing of our students.
provide immigration welfare services for international students, including applications for visa extensions.
provide Personal Tutors with information about your circumstances to better support your academic and welfare needs.
administration of external and internal student surveys (for more information please see our survey privacy notice).
administration of complaints, investigations and disciplinary proceedings or appeals concerning student misconduct, including investigations into academic misconduct in accordance with our procedure for handling academic misconduct.
operate security, disciplinary, complaint and quality assurance processes and arrangements.
make financial transactions including the processing and recovery of university fees, administration of financial awards and prizes e.g. bursaries, grants and scholarships and for the administration of financial aid e.g. hardship funds.
process job applications and employment contracts where a student is employed by the University.
allow professional and industrial bodies wishing to communicate with students about career opportunities and membership of or registration with their body and where relevant to confirm your qualifications, accredit your course, provide references/statements of good character and on health with regard to fitness to practice.
register you as a member of University alumni upon graduation and to invite you to a graduation ceremony (including administration of your attendance, publication of award details in event publications and to facilitate suppliers in providing associated services e.g. gown hire and memorabilia).
facilitate fundraising activities.
manage international recruitment.
provide access to further study opportunities and to facilitate post graduate study via our Graduate School.
provide college/school specific services.
provide access to our sports facilities, venue hire and cinema.
monitor our compliance with equalities legislation and recording lectures and other sessions for compliance
provide you with information about initiatives that improve equality of opportunity for underrepresented and disadvantaged groups (this processing may be based on specific special category data).
allow access to IT systems and monitor your use of these services in accordance with our Acceptable Use Policy.
enable effective communications with you or those you authorise us to communicate with on your behalf.
enable us to supply you with the services and information which you have requested.
ensure that content is presented in the most effective manner for you and for your computer.
analyse the data we collect so that we can administer, support and improve our services.
provide you with information, products or services that you request from us or which we feel may interest you, where you have agreed to be contacted for such purposes.
notify you about changes to our service.
provide you with access to buildings, including student accommodation (if applicable) and for administration of our CCTV system in accordance with our CCTV Code of Practice.
ensure safety, health and wellbeing (including contacting your emergency contact if required).
comply with any legal obligation imposed on us or where it is necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override them.
help us ensure good records management and achieving in the public interest.

For photos and footage capture, where possible and practical to do so, we will seek written agreement to image capture. Where this is not possible for practical reasons, unless express objections are received, individuals attending an event at the university are deemed to have given their agreement by attending or remaining at the event. Any queries should be raised with the event host in the first instance.

The University prefers to contact students through the email account we provide to you. However, there may be circumstances in which it is appropriate for us to contact you using the personal contact details we hold for you. This may include a personal email address, mobile number etc. Typically, we would try and utilise your university email address in the first instance and if this proves unsuccessful, we would look for alternatives. Examples of where we may do this include;

to make you aware of information relevant to your studies in the post-registration period where the University is still setting-up IT accounts for new starters and therefore we can’t expect to reach all new students through their university email addresses.
where there is outstanding debt owed to the University by you.
where the University has been made aware of a cause for concern relating to your wellbeing and we need to establish whether you need support.
where there is urgent and important information we need to make you aware of to keep you safe; for example where public health measures need to be put in place, where there are concerns about threats of harm against buildings (which affect users), groups or individuals, weather events or major incidents affecting safe travel etc.

Our reason for processing your personal data

We process your personal data using the following basis;

to enter a contract with you, or to perform our obligations under your contract with us.
for a legal obligation.
to perform a task in the public interest.
for our legitimate interests.
where you have given your consent.
in exceptional circumstances for a vital interest.
for statistical and research purposes.

Special category data is processed for the following reasons;

where we need to carry out our legal obligations or exercise rights in connection with your education.
processing is needed in the public interest.
processing is needed in relation to legal claims.
processing is needed to protect your interests (or someone else’s interests) and you are not capable of giving your agreement.
you have already made the data public.
where you have given your explicit written consent.
in exceptional circumstances for a vital interest.

Organisations or individuals we may share your information with in relation to this processing

We will/may share your information with;

the University of Westminster Student Union.
local authorities e.g. for council tax assessment purposes, electoral purposes, for processing of care leaver bursaries.
government departments e.g. Home Office, including UK Visas and Immigration, Foreign and Commonwealth Office, Department of Health, Department of Education, Department for Business, Energy and Industrial Strategy.
executive agencies or non-departmental public bodies (e.g. HM Revenue and Customs, Health and Safety Executive).
the Higher Education Statistics Agency (HESA). For further information on how this data will be used please visit the HESA website.
the Higher Education Degree DataCheck service which allows employers or statutory bodies and their agents to verify basic degree and enrolment information about you with your agreement. You should note University degrees are a matter of public record and we can disclose details of your qualification without your consent.
professional or statutory regulatory bodies e.g. the General Medical Council, British Computing Society, etc.
external examiners for assessment.
with commercial partners to support work placements, apprenticeships, learning placements and training where these are part of your course.
the Student Loans Company, grant funding bodies and private sponsors.
close family or next of kin and emergency services where there is an emergency such as illness or serious injury.
Office of the Independent Adjudicator (OIA).
our insurers in respect of accidents or incidents occurring with the institution and external auditors and other external regulators upon request.
the police or other regulatory bodies where pursuant to the investigation or disclosure of a potential crime or national security matters such as Benefits or Tax Inspectors, UK Visas & Immigrations and the Foreign and Commonwealth Office.

How we protect your information

The personal information we hold will be processed with appropriate security and used in accordance with the Data Protection Act 2018 the UK General Data Protection Regulation (UK GDPR) and the Data Use and Access Act 2025 (DUAA). Your information may be held outside of the UK. Where this is the case, we ensure that appropriate measures are in place to protect your data.

Our data retention policy

Your personal data will be held confidentially for as long as necessary to fulfil the purposes for which it was it collected, including for the purposes of satisfying any legal, accounting, reporting or archiving requirements.

We may aggregate and anonymise data for wider internal management reporting or for research purposes.

Personal data will be kept in line with the university’s retention schedules.

After you have graduated from the University, a core record of your studies is retained indefinitely so that the details of your academic achievements can be confirmed. These details may also be used for statistical and historical research.

Disclosure of information to third parties acting on behalf of the university

Personal information will not be disclosed to external organisations other than those listed above and those acting on the instructions of the University. Where this is the case, a written contract will be put in place between the University and the third party setting out appropriate data protection obligations.

We use several commercial companies and partners to either store personal information or to manage it on our behalf. Where we have these arrangements, we ensure that there is a contract or data sharing agreement is in place to ensure that the requirements of data protection legislation are met.

Your rights

The law gives you several rights to control which personal information is used by us and how it is used by us.

How can you access the information we hold about you?

You are legally entitled to ask to see any records we hold about you. If you wish to request access to the personal information we hold about you, please contact the Information Compliance Team through the University’s subject access procedure.

How can you request correction of inaccurate information?

Whilst we try to ensure that any personal data we hold about you is correct, there may be situations where the information we hold is no longer accurate. If this is the case, please contact the department holding the information so that any errors can be investigated and corrected. If you don’t know which department to contact please contact the Information Compliance Team.

You can ask to delete information (right to be forgotten)

In some circumstances you can ask for your personal information to be deleted, for example, in instances where:

your personal information is no longer needed for the reason why it was collected in the first place.
you have removed your consent for us to use your information (where there is no other legal reason for us to use it).
deleting the information is a legal requirement.

Please note that there are situations where the right to be forgotten does not apply. Please contact the Information Compliance Team to make a request.

You can ask to limit what we use your data for

In some circumstances, you have the right to restrict what processing an organisation carries out or ask that they stop processing your personal data. When processing is restricted, the organisation may continue to store your data but not process it further. Please contact the Information Compliance Team to make a request.

You can ask to have your information moved to another provider (data portability)

You have the right to ask for your personal information to be given back to you or another service provider of your choice in a commonly used format. Please contact the Information Compliance Team to make a request.

You can object

You have the right to object to processing of your personal data at any time. This means that you can stop or prevent an organisation from using your data. However, it only applies in certain circumstances. Please contact the Information Compliance Team to make a request.

Automated decision making and profiling

You have a right to request that decisions based solely on automated processing, including profiling, which may produce a legal effect or affect them significantly, to have some form of human input so they are not automatically generated by a computer. Please contact the Information Compliance Team to make a request.

Right to complain

You have the right to complain about how we use your personal data. In the first instance, please contact the Information Compliance Team.

How to contact us?

If you would like further information or if you have any concerns about how we handle your data, these can be raised with our Information Compliance Team by emailing [email protected] or writing to:

Information Compliance Team
University of Westminster
32–38 Wells Street
London
W1T 3UW

Independent advice

Independent advice can be sought from the UK regulator for data protection, the Information Commissioner’s Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

T: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit the ICO website or email [email protected].

This privacy notice and updates

If you have any queries about this privacy notice, or about how we hold and use your data, please contact the Information Compliance Team.

We will review and update this privacy notice to reflect changes in our processes and procedures. When such changes occur, we will revise the 'last updated' date on this notice. We encourage you to periodically review this notice to remain informed.

Last reviewed and updated May 2026.