Student Privacy Notice

1. Introduction

Glasgow Caledonian University (“GCU”) needs to process and retain certain personal data relating to you by virtue of you enquiring about, applying to be or being a student of the University. Your personal data will be treated in accordance with data protection law including the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation (UK GDPR) (“data protection law”).

GCU is a Data Controller in terms of Data Protection Legislation. GCU is registered with the Information Commissioner’s Office, our Registration Number is Z5761620.

The purpose of this statement is to inform you how your personal data will be processed by the University in order to facilitate administer and manage your time as a student with the University.

GCU may update this notice at any time. Where these changes affect your rights and interests we will bring this to your attention and explain what this means for you. We may also provide you with more detailed information on specific occasions where we collect and process personal data about you. These additional notices are supplementary to this main Student Privacy Notice.

 Any questions relating this privacy notice should be emailed to University’s Data Protection Officer (DPO) at

2. Purpose of this Privacy Notice

This Privacy Notice sets out the GCU’s responsibilities and obligations as a Data Controller – The organisation that determines the purpose and means of processing of your personal data and is responsible for protecting your personal data. In addition, it:

  • Sets out the types of personal data processed by GCU
  • Provides an overview of the purposes for which we process your personal data; 
  • Explains the legal basis relied on when processing your personal data;
  • Explains the sources of the personal data which we process;
  • Informs you who has access to your personal data and the limited conditions under which your personal data may be shared with a third party;
  • Explains your privacy rights under data protection law and the steps you can take to exercise these; and
  • Explains how GCU will protect your personal data, keeping this safe and secure.

3. Your personal data and why we need it

Personal data is defined under data protection law as is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

Personal data includes:

  • Identifiers such as your name, data of birth, student ID number, address, telephone number, email addresses
  • Personal and family details (including emergency contact details)
  • Social circumstances
  • Financial information
  • Education and student records, like qualifications, skills, and personal statements
  • Disciplinary and attendance records
  • Relevant employment details 
  • Images for authentication and identification purposes
  • Services and support provided

GCU may use special categories of personal data which are given an extra level of security and confidentiality. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or sexual orientation.

GCU may process information that you disclose about your health and wellbeing. There may also be occasions which require GCU to process your health information for public health purposes, to protect the wellbeing of GCU community and the wider public. In these circumstances, we may process information relating to your health diagnosis and symptoms and we may share this data within GCU departments and relevant authorities, where it's necessary for us to do so. Where we process your health data, we will always put in place steps to protect your privacy.

GCU will process data relating to criminal convictions or offences for applicants accepting an offer to fulfil its duty of care to ensure the safety of its students, staff, visitors and service users. This data will be subject to strict processing criteria and security arrangements.

The purpose of processing your information is generally in order to facilitate, administer, support and manage your time as a student, this includes, but is not limited to:

  • Recruitment, application, admissions and enrolment purposes, including electronic applications supporting enrolment and induction, and to provide you with information about GCU advice, guidance, IT and other support services.
  • Providing you with information about educational programmes and services.
  • Making and keeping student records on the GCU’s central systems. Maintaining your student record and managing academic processes.
  • Educational, assessment, placement, work experience and training purposes, including providing you with technology which assist you to undertake and manage your studies, working groups and collaborative learning, and assessments, and to record and reflect on your learning, as well as interact with other students in your modules through GCU Learn, GCU’s Virtual Learning Environment. This includes using online similarity checking services and video/lecture capture.
  • Support purposes, including the provision of advice and support to you, including academic services, welfare services including counselling and pastoral services, academic support, health care services, health and safety, attendance monitoring, managing extenuating circumstances, vacancy information and careers guidance, where you need or choose to access these services.
  • Undertaking enquiries and investigations in relation to complaints, student conduct, fitness to practice, fitness to study, academic appeals, and any other enquiries and investigations in line with GCU regulations, codes and policies.
  • Managing GCU services including IT services, library services and events.
  • Administrative purposes to support the other purposes including: processing immigration data where appropriate; providing support services, advice and appointments; to ensure that sufficient and up-to-date records of your module participation, academic results, educational needs and preferences; confirming qualifications and providing references; undertaking research and surveys and obtaining feedback to improve the student experience.
  • Administering financial matters including payment of fees, administering grants and loans. This includes your liability for fees, and payment of, student fees, grants and loans and use of the GCU’s online payment system for payment of fees and other costs. Financial information may be shared outside GCU including sharing information with organisations such as the Student Loans Company (SLC) and other providers.
  • For educational purposes and a part of the “core” GCU learning experience, in particular gathering of basic personal data and analysis of your patterns of study; including your use of library, log-in, and electronic study resources, including participation in group-study software; collecting marks and averaging your academic results. This automated processing is integral to our student learning experience, and is intended to help you to succeed in your studies. The process is called “learning analytics” and it allows GCU to improve its teaching and learning. No decisions will be made about you on the basis of this information unless you have given your consent to this.
  • Communications purposes including email, text messages and other electronic communications, including communicating across the GCU community and seeking your opinion.
  • Management and administration purposes relating to GCU property (including accommodation services).
  •  Providing reports to education sector bodies, such as the Funding Councils, which provides funding for students to Scottish Universities and the Higher Education Statistics Agency (HESA), which monitors and reports on UK higher education and trends.
  • For the purposes of ensuring that the GCU community remains safe and inclusive, including the management of behavioural or disciplinary issues (including use or misuse of electronic and communication systems and social media).
  • Contacting your emergency contacts.
  • CCTV for the purposes of public safety and the prevention and detection of crime. CCTV footage may also be used for investigations or proceedings arising under GCU’s regulations, codes and policies.
  • Certain telephone calls may be recorded for the purposes of training and administration, for example, telephone calls to the IT Service Desk.
  • Graduation and confirmation of awards.
  • Alumni membership.
  • Statistical and archive purposes.

4. Profiling or Automated Decision Making

We do not use automated decision-making processes.  Some processes are semi-automated but a person will always be involved before any decision is reached in relation to you.

5. Legal basis for processing your personal data

GCU must have a legal basis for processing your personal and special category data. The legal bases, as defined in data protection law, that may be relied upon by GCU are listed below:

Article 6(1)(a) Consent – in certain instances GCU will only process data if you consent, for example, you may agree to provide additional personal data in order to use certain Student Support Services.

Article 6 (1)(b) necessary for the performance of a contract. GCU will process your personal data to enable it to meet its commitments to you as outlined in our terms and conditions.

Article 6 (1)(c) necessary to comply with a legal obligation. GCU has legal obligations to provide your personal data to others, for example to the Higher Education Statistical Agency (HESA).

Article 6 (1)(d) necessary to protect the vital interests of yourself or another, in extreme circumstances GCU may have to release personal data to protect your interests or the interests of others, for example, medical emergencies.

Article 6 (1)(e) necessary for the performance of a task carried in the public interest or in the exercise of official authority.  GCU is an educational establishment and in particular its educational activity is conducted in a public interest including your interest and the interest of others.

Article 6(1)(f) ‘legitimate interests’ is generally the interest of GCU (or a third party) in providing or supporting the provision of higher education to its students. For example, undertaking surveys to enable GCU to obtain feedback on learning, teaching, programme delivery and the wider student experience.

Where special category data such as health information is processed a legal basis for this will be within Article 9 of UK GDPR or Schedule 1 of the Data Protection Act 2018 (check this in special category policy). Examples included:

Article 9(1)(a) processing “special categories” of data where you have given explicit consent.

Article 9(1)(g) processing “special categories” of data where necessary for reasons of substantial public interest.

Article 9(1)(f) processing “special categories” of data in connection with legal claims.

6. Sources of Personal Data

The personal data GCU holds about you is obtained from a number of sources including the following:

  • Personal data provided by you in person, by letter, by telephone or by email when enquiring and discussing, applying to and enrolling at GCU. This includes personal data from your previous or current:  school or other educational establishment; employer; referees; including applications made via a third party such as UCAS, partner organisations or recruitment agencies.
  • Personal data built up about you during your studies for example, marks and grades; academic assessments; conduct; your use of IT systems and Information Services; and learning analytics.
  • Financial and fees information provided by you and from funding organisations such as Student Awards Agency for Scotland, or other education authority or your sponsors.
  • Personal data obtained from partner organisations, such as professional bodies, employers, workplaces and other educational establishments, for the purposes of external study and for any placements, field trips or exchanges which may be part of your programme. 
  • Immigration, residence and visa-related personal data, where appropriate, obtained from you and from these authorities or from your own country’s educational or other bodies.
  • CCTV systems.

7. Sharing personal data with other parties

7.1 Using your emergency contact details

Emergency contact details will only be used in exceptional circumstances by GCU. Wherever possible, your permission will be sought prior to GCU getting in touch with your emergency contact. However, it may be necessary for GCU to use the emergency contact details when we feel that there are significant concerns about your health or well-being.

The decision to contact an emergency contact will be taken by two managers and will be based on the agreement that communication with an emergency contact is necessary in order to protect the student. The most common causes of this necessary communication are where a student has been reported missing and is believed to be at risk, where a student is unresponsive and has been hospitalised or where a student is mentally incapacitated and at extreme risk.

7.2 Access to and disclosure of personal data

GCU will manage your personal data securely and will restrict access to employees, advisors, agents, contractors and service providers, who will only process personal data in accordance with data protection legislation and GCU’s instructions. GCU will put in place technical and organisational measures necessary to ensure the security of your personal data.

GCU will only disclose your personal data to third parties where we:

  • Have your consent; or
  • Are required to under a statutory or regulatory obligation; or
  • Are permitted to do so under the data protection legislation.

7.3 Sharing your personal data

GCU is obliged to disclose personal data to some external bodies, including organisations which administer statistics and reports on UK higher education and institutions. To fulfil our statutory or legal obligations or to pursue our legitimate interests, your data may be provided to organisations or agents acting on their behalf including but not limited to:

  • The Higher Education Statistics Agency (HESA). HESA is the official source of data about UK universities, and it collects and analyses information about students and Universities. This work includes disclosing some of your personal data to other organisations. The information gathered is used for statistics in the public interest, and for informing census and planning in higher education, and it may be used for detecting and investigating fraud. Information about employment and occupation is also provided to HESA. When producing this material for publication, HESA applies its disclosure control, the HESA Standard Rounding Methodology, to ensure that no Personal Data is included and that individuals cannot be identified from published material.
  • If you provided information to GCU about your disability status, ethnicity, sexual orientation, gender reassignment or religion, this will be included in your HESA information and it will be used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act. Some other sensitive information is used to enable research into the provision of fair access to higher education, for example, whether you are care-experienced.
  • HESA process your personal data for the purposes of the Graduate Outcomes survey and the National Student Survey
  • For more information on what HESA does with your personal data, please see the HESA Student Collection Notices:
  • The Scottish Funding Council (SFC).
  • Data shared with SFC may be used for the purpose of maintaining a national articulation data base.
  • The Student Loans Company (SLC).
  • The Student Awards Agency for Scotland (SAAS).
  • Home Office/UK Visas and Immigration (UKVI).
  • Higher Education Funding Council for England (HEFCE) including agents managing the Research Excellence Framework (REF).
  • HM Revenue & Customs (HMRC).
  • External markers and examiners for academic administration and progression purposes.
  • Professional bodies, for example, SSSC (Scottish Social Services Council) NHS Education for Scotland (NES), Nursing and Midwifery Council (NMC).
  • Embassies and other Governments.
  • Law enforcement agencies and debt controllers.
  • Potential and current academic partners, partners in student exchanges, employers or education and placement providers.
  • Surveys covering student progress, attitudes, social and financial circumstances including the National Student Survey (NSS) and the International Student Barometer (ISB). Further information is available on the NSS website:
  • Relevant authorities dealing with health and safety and emergency situations at the University.
  • Third-party service providers
  • Relevant regulatory or investigatory bodies such as the Scottish Public Services Ombudsman, Office of the Scottish Information Commissioner and the Information Commissioner’s Office.

If your course is sponsored by a third party, we may share personal data about your attendance, participation and progression with your sponsor including your employer.

7.4 GCU Students' Association

As a registered GCU student you are automatically a member of GCU Students' Association. The Students’ Association exists to represent GCU students and provides services and activities to support and develop students.

The University provides limited information to the GCU Students’ Association for the purpose of your membership and enables GCU to support the Students’ Association to be run in a fair and democratic manner. This includes academic representation, democratic activities, running of elections, volunteering, administering clubs, societies and student groups, managing events, providing support and advice and social marketing activities. If you do not want to be a member of GCU Students’ Association, you can opt out by contacting the  Chief Executive of GCU Students’ Association.  

To share this personal data, GCU is relying on the Education Act 1994 and our public task.

7.5 Council Tax and Electoral Registration

To meet legal obligations, we may provide personal data to Councils for exemption of Council Tax. In addition, your personal data will be shared with the Electoral Registration Office in accordance with the Representation of the People Act 1983.

7.6 International Students

For international students, GCU may confirm your dates of study and academic award to your embassy to assist with the recognition of your academic award in your home country.

If you need a visa to study at GCU, you must comply with the terms of your visa and with all GCU’s requirements arising from our duties and obligations as a Home Office Points Based System sponsor licence holder.  GCU is required to report to the Home Office, details of students subject to immigration control who fail to enrol, who discontinue their studies, where their expected end date has changed or who fail to maintain contact with GCU. We may also be required under law to provide the Home Office with other personal data about you when this is requested by the Home Office. Further information can be found in in the Student VISA Privacy Notice.

8. Graduation

Graduation ceremonies are public events which are recorded and made available in live broadcasts, on campus and on the internet, and made publically available via the sale of DVDs.

GCU may take photographs and other images for possible use in GCU publicity and promotional material. Graduands who attend the ceremony will be photographed or filmed and, as we cannot guarantee that you will not be photographed or filmed, if you do not wish to be included you should not attend the ceremony.

Names of graduands, including those graduating in absentia, will be published in the graduation programme.

Lists are published in newspapers and you will be offered the opportunity to choose to be included when you register to graduate.

Your name will appear in the graduation programme. If you do not want your name included you must tell us by emailing no later than five weeks before the ceremony.

9. GCU Foundation

When you graduate or leave GCU, you become a member of the University alumni and information about you is shared with the GCU Foundation from the student records system. This information is then managed by GCU Foundation. This is undertaken under the official authority vested in GCU and in pursuit of GCU’s legitimate interests. You can find information on our separate Privacy Notice for Alumni Engagement and GCU Foundation .

10. Protecting your Information

GCU puts in place a series of technical and organisational measures to protect and safeguard all the personal data that it holds. Please see GCU’s IT regulations and policies webpages for information.

11. Where your information is held

For these purposes, personal data may also be transferred outside the UK, to countries which may not have equivalent data protection laws. Examples of circumstances when personal data may be transferred outside the UK include:

  • Participation in and management of collaborations with overseas educational institutions including student exchanges and partnership programmes.
  • Working with overseas recruitment agencies.
  • Information posted on our website which is accessible outside the UK.

When personal data is transferred outside the UK, GCU will ensure that appropriate safeguards are in place including relevant contracts and data processing agreements.

12. Email

Student email is provided by a third party. This requires GCU to disclose some personal data to this third party in order to provide the service. Students should refer to the third party's terms of use and privacy policy, which are available at the logon screen.

This personal data is held in accordance with the data protection law and will be stored either in the UK or within EEA or, if stored outside the EEA will have an adequate level of protection which has been assessed to ensure that it is protected. You control information including any personal data stored within your email account.

13. CCTV

GCU operates CCTV systems throughout its campuses for the purposes of public safety and the prevention and detection of crime. CCTV footage may also be used for investigations or proceedings arising under the GCU’s regulations, codes and policies. Our CCTV Policy is published online.

14. Retention of your Personal Information

GCU will retain your personal data only as long as necessary for its purposes as described. Please note, however, that even after termination of your student relationship with GCU, we may still need to retain your personal data to meet its obligations to keep certain records for particular periods under applicable law. We also keep a limited permanent record of you being a student in order to ensure a record of your educational achievements and qualifications is retained. All information on GCU’s Records Retention Schedule can be found online.

15. Making sure your Personal Information is Accurate

GCU strives to ensure that all personal data remain current and accurate. If you become aware of any incorrect personal data held by GCU, you have the right to request that this is rectified. There are particular areas where GCU relies upon you to inform it of any changes to your personal data; for example contact and emergency contact details. Our website tells you how to update us if your contact or other personal details change:

16. Your Rights

Data protection law provides a number of rights including the right to:

  • Withdraw consent at any time, where that is the legal basis for our processing.
  • Access your personal data and obtain a copy
  • Rectify inaccuracies in personal data that we hold about you.
  • Erasure, that is to have your details removed from systems that we use to process your personal data
  • Restrict the processing in certain ways
  • Obtain a portable copy of data you have given to us in a commonly used electronic form
  • Object to certain processing of your personal data by us

Please note that the ability to exercise these rights is not absolute and will depend on the legal basis on which the processing is being carried out.

Further information is available on the website at:

17 Data Protection Contact Details and Further Information

We will publish any changes we make to our  Data Protection Policy on our website:

 If you wish to complain about how we have handled your personal data, you can contact the Data Protection Officer who will investigate the matter. GCU’s Data Protection Officer (DPO) can be contacted at

 If you are not satisfied with our response you can complain to the  Information Commissioner’s Office (ICO).