Privacy notice

Privacy notice for Students - 2023/24

Updated on 11 December 2023

We need to collect and process information about you to facilitate your education, validate your qualifications in future, and as part of your lifelong relationship with the University of Dundee (‘the University’) as a student and member of our alumni community.

On this page

How we use your information

Your information is used for academic, administrative, management, pastoral and health and safety reasons. The University must also make certain mandatory disclosures of information to bodies such as local government, the Higher Education Statistics Agency and/or the funding councils.

You may have provided the University with your information or, other agencies may have provided your information on your behalf (such as UCAS, a healthcare provider or a referee).

We provide some examples of how your data is used below. You can also find information on how personal data is used by the University in the tables linked online on the University's Data Protection page. That page also includes additional privacy notices for specific areas of the University. Finally, you may encounter privacy notices when using the University’s systems and services that give you more information on how your data is being used.

Personal data

Your personal data will normally comprise information such as your name, date of birth, ID numbers, term time and home addresses, telephone numbers, email addresses, emergency contact information, programmes and modules undertaken and your performance on those programmes and modules etc.

Special categories of personal data

If you choose to provide the University with special categories of personal data, for example information about your personal needs when accessing pastoral care services, information about a disability so that you can be supported in your studies, or sensitive information demonstrating mitigating circumstances, the University will process your special category data. The University may also process special categories of personal data where it has an obligation to do so, for example so that it can meet its obligations under equalities legislation.

Data controller

The University is the data controller for the information it holds about you. Your data is processed in the University’s systems which include SITS, the student records system, Microsoft Office 365 (the University’s productivity software) and ‘MyDundee’ the University’s Virtual Learning Environment, provided by Blackboard.  For more information about the systems the University uses and the data they contain please email, or write to Data Protection Officer, University of Dundee, Dundee DD1 4HN.

Lawful processing

The University processes your information for different reasons in different circumstances. You can see a table providing examples of those purposes and information on why that is lawful online on the University's Data Protection page. In general, the University asserts that the processing of your personal data is lawful because:

  • it is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract (i.e. your acceptance of the University’s Terms and Conditions of Registration). Please note that it is impossible for the University to matriculate you as a student and provide you with your University education without processing your personal information;
  • it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (i.e. the powers and obligations set out in the University’s Charter, Statutes and Ordinances)

From time to time, the University may also process your personal data because:

  • you have given consent to the processing of your personal data for one or more specific purposes;
  • it is necessary for compliance with a legal obligation to which the University is subject (for example it is mandatory for the University to provide your information to certain statutory agencies);
  • it is necessary in order to protect your vital interests or those of another natural person; because it is necessary for the pursuit of our or a third party’s legitimate interests (unless those interests are overridden by your interests, rights or freedoms).

The University may also process some of your special category personal data. The University asserts that this is lawful because one or more of the following apply:

  • you have given explicit consent to the processing of those personal data for one or more specified purposes (for example when accessing pastoral support services);
  • it is necessary for the purposes of carrying out the obligations and exercising the University’s or your specific rights in the field of employment and social security and social protection law;
  • it is necessary to protect your vital interests or those of another person where you are physically or legally incapable of giving consent;
  • it relates to personal data which are manifestly made public by you;
  • it is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
  • it is necessary for reasons of substantial public interest;
  • it is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services; or
  • it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the UK General Data Protection Regulation.

Your rights

The University respects your rights and preferences in relation to your data and if you wish to: update; access; erase; or limit the use of your information, please let us know by emailing and we will respond to your request appropriately.  If you wish to complain about the University’s use of your information, please contact You may also wish to contact the Information Commissioner’s Office.

Please note that you can access and update much of the information recorded about you in the student records system via eVision.

Examples follow of how your information is used by the University. For more information on how information is used and the lawful basis for that please see the table linked on our Data Protection webpage.

Your data (including special categories of your personal data where applicable) is used:

  1. to facilitate and administer the provision of education (using a variety of methods e.g. on campus, hybrid teaching, online teaching), training and research at the University. This includes the processing of enquiries and admissions, matriculation, administration of studies, attendance and engagement monitoring, examination, graduation, administration of student awards and fees, student discipline, the provision of University software and services such as email or online learning environments, the development and maintenance of the University’s systems (or those of its providers) and/or the management of access to University buildings and facilities such as the Library, classrooms, lecture theatres or laboratories;
  2. in the provision of University support to you, including healthcare support or the protection of your vital interests or those of others. This includes the provision of support from external providers with whom the University has partnered. Where you access pastoral care services such as health, disability, counselling services or where you provide the University with information concerning mitigating or other personal circumstances, or where such information is provided on your behalf by, for example, healthcare providers, you will be given additional information concerning the processing of special categories of personal data disclosed during that process;
  3. to meet the disclosure or data sharing requirements of government agencies or other official bodies such as the Scottish Funding Council, UK Visas and Immigration (for international students), Local Education Authorities, Electoral Registration Offices, the Student Awards Agency Scotland, the Office for Students and the Student Loans Company;
  4. to satisfy the data sharing requirements of professional and accreditation organisations such as the Nursing and Midwifery Council, the General Medical Council, the General Dental Council, the General Teaching Council for Scotland and the Law Society of Scotland.
  5. to meet obligations imposed by law, for example provision of information to the police, further to the prevention and detection of crime or to Local Authorities or other appropriate agencies for tax collection purposes (including provision of your details to Local Authorities so that you can claim Council Tax exemptions etc);
  6. to seek legal advice or in the establishment, exercise or defence of legal claims
  7. to maintain the safety and security of the University for you and all members of the University community. This includes using your emergency contact information in appropriate circumstances, the implementation of measures to prevent crime and expedite the prosecution of offenders such as the use of CCTV and the disclosure of information to competent authorities;
  8. to compile, monitor and analyse statistics within the University and provide statistical information where the University is obliged to do so to bodies such as the Higher Education Statistics Agency (HESA). HESA's Student Collection Notice explains how they use personal data;
  9. to ask you to take part in surveys or other monitoring activities such as the National Student Survey or the International Student Barometer. We will provide you with additional privacy information at the time we ask you to consider participating;
  10. to facilitate research including research using your data in anonymised form or aggregated with the data of others. Research may be academic in nature or involve the analysis of data to improve the University’s educational programmes or professional services;
  11. To use your anonymised data to compile and share statistical information about courses, students or other University business;
  12. when undertaking learning analytics based upon metrics such as access to e-learning environments and resources, library access, academic performance, engagement and/or attendance. Learning analytics data may be used to support you in your studies or, in an anonymised form, be used to improve the University’s educational programmes and services;
  13. to detect and prevent academic dishonesty. This includes disclosure of your information to third parties contracted by the University of Dundee to assist in this process;
  14. to confirm your results and performance to prospective employers, relevant professional bodies or sponsors, including the provision of transcripts and references. This will include the provision of information on your conduct to competent professional or regulatory bodies where applicable and the provision of your information on your progress, attendance and use of funds to sponsors and/or funding bodies as appropriate;
  15. to develop and deliver education or research programmes in partnership with other organisations, including sharing your information between partners where appropriate, for example where programmes are delivered by more than one institution or include placements, apprenticeships or other training opportunities. Where your programme is provided in partnership with another institution or organisation per your Terms and Conditions of Registration, you should note that your personal data, including data on your performance, will be shared between the partners providing that programme. If the partner is based outwith the European Economic Area, this will include transfer of your data outwith that zone. Processing of information outwith the European Economic Area is normally based upon an ‘adequacy decision’ for the country in which the partner is based or the use of UK or European ‘standard contract clauses’. For more information, please see the University’s Guidance for transfers of personal data outwith the European Economic Area.
  16. to keep and maintain University accounts and records, including processing your financial information in respect of fees, payments and fines;
  17. to create, maintain and use data, information and records further to all aspects of the University’s activities and obligations;
  18. to make you a member of Dundee University Students’ Association so that you may access their facilities and services, including support and representative services, and to make sure that you can take part in DUSA’s democratic activities and those matters it conducts jointly with the University (e.g. Student-led teaching awards). The University also shares your personal information with DUSA when working jointly on matters including student welfare, support, discipline and campus security. Such matters include the management of issues concerning individual students directly and;
  19. to advertise and market University services to you, undertake fundraising and send promotional materials such as the University magazine (including after graduation as a member of the University’s alumni community). If you wish to ask the University to stop sending you marketing and promotional materials, please email A separate privacy notice concerning Development and Alumni Relations is provided online on the University's Data Protection page;
  20. to conduct marketing activities, which may include the sharing of your data with the University’s student recruitment partners to determine the outcome of marketing initiatives and the creation of lookalike audiences for the purposes of advertising to users with similar characteristics on platforms such as Facebook, Instagram, Twitter, Snapchat or TikTok. You can update your preferences by accessing your privacy settings on these sites.
  21. Students of International College Dundee should note that their information will be shared between the University and its partner, Oxford International Education Group (OIEG), to facilitate their education and entry to the University via this route. The sharing of information takes place under an agreement between the partners designed to safeguard your personal data. OIEG will only use this information as directed by the University.
  22. Students of joint educational partnerships should note that the award of joint degrees requires the sharing between the University and the overseas institution of all appropriate personal and educational performance information which may include the entire text of the dissertation or final year project. This is required to permit the validation and recognition of the achievement of the degree within external jurisdictions.

In certain circumstances, the University may require disclosure of criminal conviction data. For more information on how that information is used please see the separate Privacy Notice published on the University's Data Protection page.

All processing of personal data, including special categories of personal data, at the University requires the use of software or services provided by third parties in partnership with or procured by the University. This may involve disclosure of your information to countries outwith the European Economic Area (EEA), for example when the University works in collaboration with other institutions in the provision of your programme or when using software from providers based or with data centres located overseas. Processing of information outwith the European Economic Area is normally based upon UK ‘adequacy regulations’ for the country in which our supplier is based, the adoption of ‘binding corporate rules’ by our supplier or the use of ‘appropriate safeguards’ through putting an appropriate agreement or legal instrument in place. For more information, please see the University’s Guidance for transfers of personal data out with the European Economic Area.

During your time as a student of the University you may be asked to consent to being photographed or recorded for promotional or other purposes (such as research). You may also notice signage around campus when photography, filming or other recording is taking place. If you have any concerns about the use of your image or wish to withdraw consent for it to be used, please contact the University's Data Protection Officer in the first instance at

Please note that it may not always be possible for you to withdraw your consent (for example where many print copies of a brochure have been made), but we will discuss this with you according to individual circumstances.

Please note that any contributions you make in class may be recorded by the University or by other students. Such recordings are governed by the University’s policies on students recording lectures and lecture capture (i.e., recording lectures so that they can be viewed again by students and staff).

The University undertakes various activities to protect its IT systems and networks and the users of those systems. These actives help the University to prevent fraud; to monitor, as appropriate and reasonable, business and personal use of our information and communication systems to ensure compliance with our IT policies, legislation and regulation; and to ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution. For more information, please see the IT privacy notice on the University's Data Protection web page.

Where a formal investigatory (or similar) process is required and approved as appropriate by the University’s senior managers, the University may, in very limited circumstances, review the content, logs, metadata and/or other administrative information from the University systems. This includes systems such as email, web browsing, network log-ins and access points, door entry data, library systems, the VLE etc. The University recognises the significance of taking such action and has a strict procedure accordingly. The Interception of Communications procedure is available on the University's Data Protection web page.

The University will retain your personal information as long as it is operationally necessary to do so. Recognising your lifelong relationship with the University, please note that your information will be retained beyond the termination of your student relationship with the University to manage your time as a member of the alumni community, verify your qualifications and satisfy obligations placed upon the University of Dundee by law, regulation and convention. For more information, please see the privacy notices published online on the University's Data Protection web page.

If you have any questions or concerns about the use of your information, please contact the University's Data Protection Officer for more information at More information on data protection at the University is available on the University's Data Protection web page.

IT security

As a matriculated student of the University you have access to IT services including your own dedicated University email address. To maintain the security of your information, the University will not normally email you at a personal email address during your time as a student. However, we may do so in exceptional circumstances, for example when concerned for your welfare.  You will be asked to create a password to secure your information and any University information you may create or have access to during the course of your studies or research. You must never share your password. Further guidance in relation to using University IT facilities and services can be found in the Acceptable Use Policy.


Upon matriculation you become a member of the University and are subject to its Charter, Statutes, Ordinances and Regulations.


I understand how the University will hold, use, and process my information and that I can contact the Data Protection Officer with any questions or to exercise my rights in respect of my information.


Data Protection
Corporate information category Data protection