Data Protection Statement for student registration

This Data Protection Statement (Privacy Notice) applies to students and student apprentices registering after 1 August 2026.

If you are a student apprentice you should additionally refer to the supplementary statement at the bottom of this page.

It explains in detail the types of Personal Data we process about students and student apprentices, how we obtain this data, under what circumstances we may need to share this data and how we otherwise process this data. It also explains some of the measures we have taken to keep Personal Data secure, as well as the basics of the relevant legislative framework and what your rights are in relation to your Personal Data.

Please contact dataprotection@bath.ac.uk if after reading this notice you have any further questions, suggestions or concerns about your Personal Data and how the VR成人视频 stores and processes it.

Specific terms used in this notice

Where we refer in this statement to your 鈥楶ersonal Data鈥�, it refers to any recorded information that is about you and from which you can be identified.

Where we refer to the 鈥楶谤辞肠别蝉蝉颈苍驳鈥� of your Personal Data, we mean anything that we do with that information, including collection, use, storage, disclosure, deletion or retention.

In UK GDPR terms, the University is a 鈥楥辞苍迟谤辞濒濒别谤鈥�, an organisation that decides why and how Personal Data is processed. Organisations that process Personal Data on behalf of a Controller are known as 鈥楶谤辞肠别蝉蝉辞谤蝉鈥�.

Understanding what student information the University processes

Through a variety of ways, the VR成人视频 collects data about you in the course of our dealings with you as a future, current or former student; for example, when you make enquiries, when you register, when you engage with our Student Services and as you progress through your course. We may also receive data about you from outside the University, such as information from UCAS relating to applications, and information supplied by referees. If you are a candidate, current or former student the University will likely process the following information about you:

Your name
Your student number and any other University assigned identification codes
Details of your qualifications achieved and/or currently being undertaken
Details of relevant unspent criminal convictions
Copies of identity document/s such as your passport information
Your permanent home and semester/term/placement time addresses
Your contact details including email and other electronic identifiers
Your identified gender
Date of birth
Your nationality
Relevant medical information you choose to share with us, or allow to be shared with us
Your University attendance, suspension or exclusion information
How your studies are funded, including fee information and any sponsorship details
Equality of opportunity monitoring data
Details of your academic record including qualifications, skills, experience and educational and employment history
Details of your examination and assessment results during your time at the University
Details of any pastoral, financial, care or academic support given prior to, or during, your time at University
Details of any disciplinary or conduct issues
Details of any professional body registration
Your provided photograph(s) - your photograph will appear on your university Student ID/ Library card and may also be used for other reasonable identification purposes. Appropriate provision will be made for those wishing to cover their face for religious reasons.
Emergency contact details - Where you provide us with emergency contact details you should let that person know that you are sharing that information with the university.
Trusted contact details - optionally you can provide us with the details of a Trusted contact 鈥� Where you provide us with trusted contact details you should let that person know that you are sharing that information with the university.
Feedback on university experience you have provided to external organisations (e.g. NSS) - NSS information is shared with us by the Office for Students (OfS) via the responses you provide to the Ipsos survey.

Your rights under Data Protection law

You have rights under Data Protection laws and as a University with a strong human rights ethos, we value these rights, and the Data Protection team will help you with your request without undue delay. We only charge for this in very specific and unusual situations, and we would inform you of this before you incur any costs. Below are the most important individual rights under UK GDPR.

The right to be informed

We are required to inform you about how we process Personal Data related to you, for instance, by providing you with privacy notices such as this. We will make every reasonable effort to answer any questions you may have about how we process your Personal Data.

The right of access

You have the right to ask us to make a reasonable and proportionate search for your personal data. This is known as a Data Subject Access Request, 鈥楧SAR鈥� or more commonly, 鈥楽AR鈥�, and you may for instance do this if you are concerned that data the University processes about you is incorrect or otherwise unlawful.

We may need to verify your identity, ask you to specify or narrow down your request, withhold or redact some data due to specific legal exemptions, for instance to protect the Personal Data of others. Please contact dataprotection@bath.ac.uk for further information or to make a request.

The right to rectification

You have the right to ask us to rectify Personal Data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. We hate to get things wrong, so please use this right if you feel that the information we have about you is incorrect or incomplete.

The right to erasure

You have the right to ask us to erase your Personal Data, often referred to as the right to be forgotten. This right can usually only apply to data we process on the basis of your consent, or where processing is inappropriate. Within our core functions as a University, the right to erasure is particularly limited, as we are legally required to keep detailed records.

The right to restriction of processing

You have the right to ask us to restrict the processing of your Personal Data. For instance, if you opt-out of alumni fundraising communications, we will stop sending such emails to you as you have restricted that form of processing, but we may still process your email address for other reasons.

The right to object to processing

You have the right to object to the processing of your Personal Data.

The right to data portability

You have the right to ask that we transfer the Personal Data you gave us to another organisation, or to you. This may usually only apply to information you have provided us yourself, and that is in digital form.

The right to complain about how we process your data

You have a statutory right to complain to us if you believe that we infringed your rights under UK GDPR. Please view our Data Protection Complaints Procedure for more information

Lawful Bases for processing your Personal Data

The law says we may only process Personal Data if we have an appropriate 鈥榣awful basis鈥�. The relevant lawful bases are set out in the UK General Data Protection Regulation. The lawful bases that apply will affect what specific rights you have in relation to your data. The provides useful information.

We list these seven lawful bases below, together with some of the most common situations, but more specific information will be provided to you in relevant Privacy Notices when data is collected from you for different purposes, e.g. when you sign up for lessons in the Sports Training Village or when you require Student Support.

Public Task

This is the primary lawful basis used by UK Universities to process student data while performing their core statutory and charter-based functions is Public Task, as universities perform a task in the public interest, and the task or function has a clear basis in law, examples include:

lecturing and tutoring
marking exams
awarding degrees
scientific research

You may give clear consent to the University for us to process specific Personal Data for a specific purpose. You have the right to withhold your consent or to withdraw your consent at any time.

For instance, you will be asked to provide us with Equality, Diversity and Inclusion (EDI) data and in such situations we only process this data with your Consent; these questionnaires include a 鈥榩refer not to say鈥� option which you are free to use instead.

Contract

This is an appropriate lawful basis when the University requires your Personal Data strictly to enter into, or deliver, an agreement or service requested by you. Examples include:

accommodation
employment (many University departments hire students to work for them, e.g. with Campus Services, a Professional Services team, or within an academic department)
a subscription from our Sports Training Village

Legal Obligation

The processing is necessary for us to comply with the law, for example:

processing and submitting statutory student and staff records to the Higher Education Statistics Agency
right to Work/Study Checks: verifying and retaining immigration, visa, and passport documentation mandated by the Home Office
Prevent Duty: fulfilling statutory safeguarding requirements under counter-terrorism legislation
a court may require us to keep, or share, specific information

Vital Interests

The processing is necessary to protect your life or that of somebody else.

For instance, safeguarding reasons. If the Student Support team reasonably believes you may be at risk of self-harm or risk of harm to any person, especially children. This only relates to harm that is serious, foreseeable, and imminent.
Your information needs to be shared for urgent medical reasons, and you are not able to provide/withhold consent

Legitimate Interest

The processing is necessary for the University鈥檚 legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual鈥檚 Personal Data which overrides those legitimate interests. Legitimate Interest is generally seen as the most flexible lawful basis, but is only used by the University following a documented assessment of the following questions:

purpose test: is there a legitimate interest behind the processing?
necessity test: is the processing necessary for that purpose?
balancing test: is the legitimate interest overridden by the individual鈥檚 interests, rights or freedoms?

We use Legitimate Interest for processing surveillance video 鈥淐CTV鈥�, and for the use of Automated Number Plate Registration systems that help us to ensure that the University's Car Parking Terms and Conditions are adhered to. Some of our alumni relations are also processed on a Legitimate Interest basis and we rely on this basis to hold the 'emergency contact鈥� details you provide to us.

Recognised Legitimate Interest

Recognised legitimate interest is not the same as Legitimate Interests, and can only be used in for a limited number of specific, pre-approved, purposes that are in the public interest, the University itself would rarely rely on this basis as the Public Task lawful basis will usually be more appropriate, but third parties may rely on this basis to share information with the University when this is necessary for us to perform our public tasks or official functions, particularly in the context of:

crime prevention
security
safeguarding (in situations where the more limited Vital Interest basis does not apply)

Special category data and data related to criminal convictions

UK GDPR specifically prohibits the processing of certain types of Personal Data which are considered more sensitive under human rights law, including health data, ethnic origin, information related to religious beliefs and sexual orientation.

However, clearly, such information is often vital for the University to do research, to be able to provide tailored support, to implement reasonable adjustments and to make sure that the University is a safe and welcoming place for everyone. Organisations are only allowed to process special category data when, besides the above-mentioned lawful bases, additional conditions are met.

Please contact dataprotection@bath.ac.uk if you have specific questions, but the following special category conditions may apply:

Article 9(2)(a) where the data subject has given explicit consent. UK universities rely on explicit consent for optional, student-led, or peripheral services where the individual has a genuine choice; for example, if you wish us to share details about your dietary restrictions (e.g., Halal, Kosher, or medical dietary requirements triggers).
Article 9(2)(c) to protect your vital interests or those of another person where you are incapable of giving your consent; for instance, in cases of confidential safeguarding referrals.
Article 9(2)(f) for the establishment, exercise or defence of legal claims.
Article 9(2)(g) substantial public interest allows the University to process information to assess fitness to practise and regulatory activities, or for the purpose of fraud prevention.
Article 9(2)(j) allows the processing of special category data when it is necessary for archiving in the public interest, scientific or historical research, or statistical purposes, provided suitable safeguards and legal proportionality are met.

Similarly, under Article 10 of the UK GDPR, universities can only process criminal offence data (such as criminal convictions, unspent records, or DBS checks) if they can identify an appropriate specific condition under Schedule 1 of the Data Protection Act 2018 and there are relevant conditions for research, academia, anti-doping in sport, and counselling.

The University will, for instance, require data relating to criminal offences and convictions in order to determine your eligibility to participate in regulated programmes of study and to appropriately assess the risks of any licence condition(s) or other restrictions you may have in place. This information will be subject to strict access controls and treated confidentially by the appropriate members of staff.

How the data will be used

The following are examples of how your Personal Data may be used at the University, these activities are undertaken under one or more of the lawful bases explained above. However, due the complex relationship between the University and its students, this list cannot be exhaustive:

to administer your studies and record academic achievements (e.g. your unit choices, examinations and assessments, and the publication of pass lists)
to assist in pastoral and welfare needs (e.g. therapeutic, mental health & wellbeing services, services to students with disabilities, and support for students with low or non-engagement with their programme of study)
to enable engagement monitoring for student visa holders
in the event of medical needs or emergencies, for example where we have reason to believe that you or another person may suffer harm
to administer financial aspects of your registration as a student (e.g. payment of fees or debt collection) or to administer entitlement to scholarships or bursaries
to manage course facilities, such as computing facilities, sports facilities and clubs, and the library
to produce management statistics and to conduct research into the effectiveness of our courses and services
to monitor our equality and diversity policies (e.g. compliance with the Equality Act)
to contact you with tailored placement and careers opportunities
to communicate relevant support or other group-specific information direct to applicable students
text messaging for relevant activities or reminders about surveys, e.g. NSS.
to administer employment processes, if you choose to work for the University
for security and disciplinary purposes
for internal and external audits, and quality assurance exercises
for marketing and alumni relations purposes

The University also takes photographs on campus and during events and may record lectures, seminars, tutorials, presentations, and other events. The student data captured or held may therefore include visual images of students and audio recordings of their voices. The University retains the right to record any words that you may speak or performances that you may give in lectures, presentations or other events including graduation ceremonies which are recorded in accordance with our Intellectual Property Policy and Ordinance 25.

Sharing the data

Like any 鈥楥辞苍迟谤辞濒濒别谤鈥�, we use 鈥楶谤辞肠别蝉蝉辞谤蝉鈥�; third-party organisations that process Personal Data on the University鈥檚 behalf, or that have potential access to this Personal Data while the University remains primarily responsible. Examples include Microsoft (which hosts our cloud ecosystem on its UK and EU servers) or the company that prepares and posts our alumni magazine. Crucially, any Processor is legally and contractually required to implement all reasonable technical and organisational measures to keep the data secure, and to return the data to the University if instructed to do so. And your rights under UK GDPR are not affected by our use of Data Processors 鈥� in a strict legal sense, the use of Processors is not data sharing.

The VR成人视频 will also disclose your Personal Data with third parties where we are legally required to do so, or where this is otherwise appropriate. When information is shared with third parties, we will seek to share the minimum amount necessary.

Students' Union

The Students鈥� Union (SU) is independent from the University, but we will share relevant data with the Students' Union to enable them to, for example:

assist in pastoral and welfare support
monitor their compliance with the Equality Act and in support of their equality and diversity policies
communicate relevant support or other group-specific information direct to applicable students

Data relating to disciplinary matters can also be shared.

You can specify your preferences for communications from the SU by logging in to your account at .

If you do not want to be a member of the Students' Union, please read the Code of Practice for the Students' Union.

Higher Education Statistics Agency (HESA)

The University is required to provide certain information about its students to the Higher Education Statistics Agency (HESA), which forms part of Jisc and collects data on behalf of the higher education sector. This information forms part of the statutory student record and supports the funding, regulation, planning, and quality assurance of higher education in the UK. Read .

National Students Survey (NSS)

The NSS is an annual survey of undergraduate students who are in the final stages of their programmes of study. It is designed to gather students' views on the quality of the teaching, assessment and support which they have experienced. This information is used to produce statistics and provide summary feedback to individual institutions and student unions. The survey is commissioned by the on behalf of a range of funding bodies and Higher Education providers and can be found on the .

Other Student Surveys

Both during your time at the University and after you graduate, we pass your details to respected third parties where applicable (e.g. the Financial Times Rankings for MBAs). This allows those parties to contact you directly about your time at the University and afterwards, should you wish to participate.

Sponsors and funding bodies

The University may disclose student information to the Student Loans Company, Student Finance England and any other financial sponsor (including your Embassy if relevant) to enable financial matters, including the clarification of fee status, to be determined. Disclosure to such organisations and/or sponsors will only be made where there is a legitimate reason for doing so.

In other cases, the University will not release data about you to bodies or individuals who have funded your education (such as your parents or employer(s)), unless you tell us that we can do so. However, because individuals under 18 cannot legally bind themselves to certain types of commercial debt contracts, we usually require a parent or guardian to co-sign accommodation or tuition contracts as a guarantor. This means that the University may advise your guarantor about the amount and nature of any debts you owe to the University, and, if you default, the University has a legal right to chase your guarantor for payment.

Agent, marketing, and student recruitment partners

The University has a network of third-party network providers and partners, including international agents, that are authorised to act on behalf of the University to support student recruitment, marketing and engagement activities. The University may disclose student information to these providers and partners for reporting and reconciliation purposes.

Study abroad/placement/University partnership arrangements

If your course involves spending time at an institution outside the University, at an organisation for a work placement, or if you have come to the University as a visiting, exchange or junior year abroad student, we will need to share information about you with the other institutions involved in the exchange.

This will be done for the administration of the visit, placement, exchange or study abroad, and so that the other organisation can carry out its duties in regard to your studies. If you are involved in a visit, placement, exchange or study abroad, the University will transfer the data about you as necessary for purposes connected with your studies.

If you are registered at the University but are studying at a partner institution (e.g. MPharm degree at the University of Plymouth), your details will need to be shared in order to be properly registered with our partner.

References and confirmation of qualifications

The University may release data about you in response to a request for a reference or for confirmation of your qualifications. The details of your award (e.g. degree subject and classification) are regarded as public information and will be published on open pass lists and accessible by third parties such as newspapers and prospective employers.

Graduation services

The University may share information about you and the award you are aiming for with third parties for the purpose of ensuring the appropriate provision of services such as gown hire.

UK Visas and Immigration

This section applies to students who require a visa to enter the UK to study at the University. To assist in preventing immigration fraud, the University is required to report details of students subject to immigration control who fail to register, discontinue their studies, or fail to maintain contact with the University to . We may also be required to provide UKVI with other information about students. From time to time, the University also receives enquiries from UK immigration officials regarding the status of applicants or students, e.g. to check whether an offer of a place has been made or whether a student has enrolled.

The University will normally provide information about applicants and students when requested to do so by UK immigration officials. Failure to do so, in some cases, could lead to the University's removal from the list of institutions approved to receive overseas students. We will maintain the records about students (e.g. attendance) which we are required to maintain to meet UKVI's requirements.

Other disclosures

Examples of some of the other situations in which we may disclose information to third parties:

disclosure to law enforcement agencies, where necessary for crime prevention or detection
disclosure to local authorities, for purposes connected with electoral registration, council tax or the investigation of benefit fraud
disclosure to the and/or during institutional review and other quality assessment exercises
if you leave the University owing money to the University, we may at our discretion pass this information to a debt collection agency
we may disclose information for the purpose of verifying the data about you held by the University, by another higher education institution or by government agencies

International transfers of your data

There will be occasions when we transfer your data overseas, for example because some University data is held on servers in the EU, or to obtain a reference or to verify information in your application. Such transfers will only take place if one of the following applies:

the country receiving the data is considered by the UK to provide an adequate level of Data Protection, this includes countries in the European Economic Area
the organisation receiving the data is covered by an arrangement recognised by the UK as providing an adequate standard of Data Protection
the transfer has your consent
the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract
the transfer is governed by a Transfer Risk Assessment (TRA) and International Data Transfer Agreement (IDTA).

How long will your Personal Data be retained?

The VR成人视频 will retain your Personal Data in line with the University Records Retention Schedule.

The University will maintain a core student record of your studies permanently. Details of what will be held as part of that record can be found in Section 5 of the Records Retention Schedule.

All graduates (except for those enrolled on continuing and professional education or development courses) automatically become members of the VR成人视频 Alumni Community. As such, some Personal Data is processed by the University鈥檚 Advancement Team beyond graduation to keep you informed of developments and to offer engagement opportunities.

Understanding your responsibilities

The University will make every reasonable effort to keep your details up to date. However, it is your responsibility to provide us with accurate information about yourself when you apply and when you register, and to let us know of any subsequent changes to your details, such as changes to your name or address.

Student apprentices

If you are a student apprentice, the University will also:

disclose information to the Department for Education (DfE), and your employer, to enable financial matters including the confirmation of eligibility for funding to be determined. This will include Personal Information as required by the terms of the DfE鈥檚 Funding Rules and will be shared on a regular basis.
regularly share information relating to your studies and your apprenticeship between the University and your employer

Department for Education (DfE) Privacy Notice

Each apprentice should read the DfE Privacy Notice. This explains how it will use your personal information. It can be viewed at the .

Automated Processing

The University does not make solely automated decisions that have legal or similarly significant effects on students. Where automated tools are used to support decision-making, meaningful human involvement remains the dominant part of the process.

How to raise a query, concern or complaint

If you still have queries, concerns or wish to raise a complaint; you can contact the University Data Protection Officer at dataprotection@bath.ac.uk or view the University鈥檚 Data Protection Complaints Procedure.

Alternatively, you may wish to contact the , the UK鈥檚 independent regulator for Data Protection, Privacy and Information Rights. The VR成人视频 is registered with the ICO under number .

This version was last updated in August 2026 to reflect changes in Data Protection law and University practices.

VR成人视频