Student privacy notice

When you apply, register or enrol at the University of Derby on any undergraduate, postgraduate, research based, apprenticeship programme and those registered on continuing professional development modules, a record will be created in your name.  You will be assigned a unique student ID number, login and University email address. 

During your student journey we collect and process personal data relating to you. The University is committed to being transparent about how we collect and use that data to meet our data protection obligations.

Additional information may be collected for cohorts of students on courses that are regulated by professional and regulatory bodies, apprentices and non-EEA students with immigration considerations that may affect their right to study.

We keep records of your participation in learning activities and your use of other services we offer, e.g. disability services and employability services. 

What information does the University collect?

Data that we collect may include 'special category data' such as racial or ethnic origin, religious beliefs, physical or mental health, or sexual orientation.  You may also give us information about your criminal convictions.

You may provide us with further information if you use some of our services, for example, our employability service.  Should this happen we will explain what we do with this additional data.

Information held about you may include:

The University also needs to collect and process personal ‘special categories of data’ under the GDPR including:

Why do we collect your data?

The University needs to collect, maintain and use your personal data in order to administer your course, facilitate your education and to deliver and improve services and facilities during your time as a student.  It also helps us to work with you for example providing disability support and support for students from overseas. 

We may collect your personal data in a number of ways, for example:

We may receive some information about you from third parties

We may contact the Higher Education Statistics Agency (HESA) or other educational institutions to confirm the qualifications you have obtained or to check whether you have been included in a previous HESA or funding from a UK funding authority or government agency, such as a loan or grant, we will receive basic information from the funding provider.  If your fees are paid by another organisation, they may provide some information about you to us.

Legal basis for holding your data

Our legal basis for collecting / processing the data you have submitted is ''contractual' enabling us to provide you with the services you require throughout your student journey.

How your data is held?

Your personal data is held within our University records database and accessed by staff across the University.

Who has access to data?

We may disclose certain personal information to external organisations to carry out our legal responsibilities, functions and to manage our operations or because you have asked us to.  Some data that we share is anonymised or aggregated.  These may include:

Some of the personal data we process about you will be transferred to, and stored at, a destination outside the European Economic Area ('EEA'), for example where it is processed by staff operating outside the EEA who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers based outside the EEA or who uses storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred on one of the following bases:

We will not normally disclose any other personal information about you to other external organisations without your consent unless it is in your vital interests to do so, for example, an emergency situation.

The University also subscribes to SafeZone, an alert system that allows the University to reach across the University’s population, via a ‘mass alert’ to advise of a major event, that could endanger life. The University uses the lawful bases public task to share your university email and personal phone number for this purpose.

How does the University protect data?

We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

How long we will keep your data?

Unless we have provided you with other notices concerning the retention of your data, we retain your personal data until the end of our association with you plus six years.

After this time we retain a minimum amount of data please see our alumni privacy notice.

We do retain a core record of data indefinitely, in order to provide you or employers references and verify your study with us after you have graduated.

Your data will be kept according to our Records Retention Policy.

Data subject's rights

As a data subject, you have a number of rights. You can:

Use of automated decision making and profiling

The University does not currently undertake any profiling activities or make automated decisions about you.

The right to complain to the Information Commissioners Office

If you are unsatisfied with the way the university has processed your personal data, we ask that you let us know so that we can try and put things right, or if you have any questions or concerns about your data please contact us.

If we are not able to resolve the issue to your satisfaction, you have the right to complain to the Information Commissioner’s Office.

Data Controller

The Data Controller is the University of Derby, Kedleston Road, Derby. If you would like information about how the university uses your personal data please email us at

Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it. Our Data Protection Officer is Mr James Fussell. Contact our Data Protection Officer at

Other privacy notices

We do our utmost to protect your privacy. Please be aware that other privacy notices exist within the university in respect of data held, including but not limited, to activities in relation to your enquiries, application, current students, alumni and use of our website.

November 2019
  • Reviewed and confirmed as up to date
June 2020
  • Data Protection Officer - Updated
January 2021
  • Data Protection Officer - Updated
September 2021
  • 'Why do we collect your data?' - Addition of DfE
  • 'Who has access to data?' - Addition of DfE
January 2024
  • Addition of SafeZone - Mass alert system