Student Services Confidentiality and Information Sharing Policy

The purpose of this policy is to ensure that information held by Student Services is managed appropriately and consistently. All information held by Student Services is confidential. Staff within Student Services are committed to ensuring that your personal information is protected in line with this policy and GDPR regulations.

About our student records 

Students' personal data is held within our Student Services record system and can be accessed by staff, within the Student Services, as needed to carry out their duties. The Student Services record system may hold information provided by the student and/or third parties.

In addition, staff within Student Services have access to information held in the University student record system.

Find out more about how we handle student information

What does consent to share mean?

The sharing of identifiable, personal information about a student can only happen with their consent, unless there are exceptional circumstances, as outlined below.

A student can request for information to be shared through the completion of a Consent to Share Form, which can be requested by email at studentservices@derby.ac.uk. 

Following consent, Student Services ensures that the information is shared in line with the Consent to Share form and that it is shared securely.

Internal information sharing

Information held within Student Services may be discussed within the department for purposes of supervision and coordinating support for students.

Student Services will not share information about a student with any other University of Derby Department or College without the student’s express permission. However, where permission cannot be gained and there is a cause for concern, then limited, factual, information may still be shared.

External information sharing 

Where possible we seek to gain a student’s permission before discussing their support with any external agency.

However, there may be occasions when we recognise that a student is in a health crisis and it is in their best interest for the external sharing of information to take place, even if permission cannot be gained.

Any disclosure of confidential information will be restricted to relevant information and conveyed only to appropriate people, for appropriate reasons as below:

Information sharing and suicide prevention

The University of Derby’s practice, in relation to data sharing, is in line with the Information Sharing and Suicide Prevention Consensus Statement and recognised best practice.

The Information Sharing and Suicide Prevention Consensus Statement states that ‘practitioners should disclose relevant confidential information to an appropriate person – including family or friends – or authority to protect a vulnerable person from risk of death or serious harm.’

We work jointly with individuals who are at risk of suicide, to identify those people or services that are best placed to support and keep them safe and when beneficial we support individuals to make contact themselves or seek consent to make contact on their behalf.

We will only contact people or services, without a person's consent, when there is a significant safety concern and it is believed that this action will protect the person from risk of death or serious harm. This action will only be taken if the person will not provide consent or they are assessed as not having mental capacity to consent.

This relies on effective clinical judgement, working with individuals, to identify the appropriate service/person, who are best situated, to protect them from risk of death or serious harm.

The decision to share data, without consent, will only be made by a qualified and registered mental health professional and this decision would be made in consultation with a second mental health professional. 

How can I access my records? 

Students have a right to any information stored about them. The only exception to this is if the disclosure of information would be likely to cause serious harm to physical or mental health or would breach the confidentiality of another person. If the decision is made to withhold information a justified reason will be recorded.

If a student wishes to have access to the information stored about them or they wish us to share information with a third person they should discuss this with a member of Student Services. To request a copy of your data you can contact gdpr@derby.ac.uk.

Find out more about individual rights and timescales

In some circumstances, records can only be accessed with an appropriate member of staff present.

We will not provide access to our records if requested by other parties unless directed to by a court order.

Retention of records 

All records will be retained for seven years from the end of the academic year a student had contact with the service. At the end of this time, records are deleted securely. If a student wishes to withdraw consent to their records being stored, this can be done by contacting gdpr@derby.ac.uk.

Find out more about how we handle student information