Data Protection

Glasgow Caledonian University (GCU) is a Data Controller in terms of the Data Protection Act 1998 (DPA). The University is registered with the Information Commissioner’s Office, our Registration Number is Z5761620. GCU needs to process and retain certain personal information relating to you because you are a student of the University. All of your personal information will be treated in accordance with the terms of the DPA and the General Data Protection Regulation, which comes into effect on 25 May 2018. This means that confidentiality will be respected and that appropriate security measures will be taken to prevent unauthorised disclosure.

Special categories of personal information  

Information about special categories of personal information is afforded an extra level of security and confidentiality. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or sexual orientation.

Source of information

The personal information GCU holds about you is obtained from a number of sources including the following:

  • Information you have provided on your application form (including applications made via a third party such as UCAS or recruitment agencies)
  • Information you provide us with during the course of your study
  • Information built up about you during your studies e.g. grades
  • Funding organisations such as SAAS or sponsors
  • Partner organisations such as professional bodies, employers, and other educational establishments for the purposes of external study or exchange

Personal information processed under contract

Why we process your personal information

When you apply and accept an offer, you enter into a contract with the University and agree we can process your personal information for administrative and educational purposes.  The purpose of processing includes, but is not limited to:

  • Administering and providing education and training
  • Managing and administering the University, including accommodation services
  • Administering grants and loans
  • Providing advice and support to you, including health care services, health and safety, attendance monitoring, welfare and pastoral services, vacancy information and careers guidance
  • Managing behavioural or disciplinary issues and complaints
  • Recruitment, admission and enrolment
  • Providing you with information about educational programmes and services
  • Maintaining your student record and managing academic processes
  • Administering financial matters including payment of fees
  • Managing University services including library and events
  • Research including monitoring quality and performance
  • Graduation and confirmation of awards
  • Alumni membership
  • Statistical and archive purposes.

For these purposes, personal data may also be transferred outside the European Union, to countries which may not have equivalent data protection laws.  Examples of circumstances when personal data may be transferred outside the EU include:

  • Managing collaborations with overseas educational institutions including student exchanges and partnership programmes
  • Working with overseas recruitment agencies
  • Information posted on our website which is accessible outside the EEA
  • Some of the systems and services the University uses to store data in the Cloud which may include storage facilities based outside the EEA.

Access to and disclosure of information

The University will manage your information securely and will restrict access to employees, advisors, agents, contractors and service providers, who will only process information in accordance with the Act and the University’s instructions. The University will put in place technical and organisational measures necessary to ensure the security of your information.

 The University will only disclose your information to third parties where we:

  • Have your consent; or
  • Are required to under a statutory or regulatory obligation; or
  • Are permitted to do so under the Act.

Sharing your personal data with other bodies

To fulfil our statutory or legal obligations your data may be provided, without your explicit consent, to organisations or agents acting on their behalf including but not limited to:

  • The Higher Education Statistics Agency (HESA).  For more information on what HESA does with your personal data please see the HESA Student Collection Notices (
  • The Scottish Funding Council (SFC)
  • The Student Loans Company (SLC)
  • The Student Awards Agency for Scotland (SAAS)
  • Home Office/UK Visas and Immigration (UKVI)
  • Higher Education Funding Council for England (HEFCE) including agents managing the Research Excellence Framework (REF)
  • HM Revenue & Customs (HMRC)
  • Professional bodies, for example, SSSC (Scottish Social Services Council)
  • Embassies and other Governments
  • Law enforcement agencies and debt controllers
  • Potential and current partners, employers or education and placement providers
  • Research surveys approved by the University covering student progress, attitudes, social and financial circumstances including the National Student Survey (NSS) and the International Student Barometer (ISB)
  • Relevant authorities dealing with emergency situations at the University.

In particular, your name and the term time address that you provide will be released to the local authority for Council Tax exemption purposes and may be shared with the Electoral Registration Office in accordance with the Representation of the People (Scotland) Regulations 2001. Also, for international students, the University may confirm your dates of study and academic award to your embassy to assist with the recognition of your academic award in your home country.

The University also provides limited information to the GCU Students’ Association for the purpose of academic representation, running of elections, administering clubs, societies and sports clubs and social marketing activities. If you do not want us to share your information with the Students’ Association you can opt out of this by contacting:

If you need a visa to study at GCU you must comply with the terms of your visa and with all the University's requirements arising from our duties and obligations as a Home Office Points Based System sponsor licence holder. GCU is required to report to the Home Office details of students subject to immigration control who fail to enrol, who discontinue their studies, where their expected end date has changed or who fail to maintain contact with the University. We may also be required to provide the Home Office with other information about you.

Profiling or automated decision making

We do not use profiling or automated decision-making processes.  Some processes are semi-automated but a human decision maker will always be involved before any decision is reached in relation to you.

Personal information processed by consent

Where the processing of personal information falls outwith the scope of your contract with the University (i.e. the information that the University is required to process to manage and administer your time at University) then we will require another legal reason to process your data. This may require us to ask for your consent for processing.  Consent will be sought when it is required. 

Retention of your personal information

GCU will retain your personal data only as long as necessary for its purposes as described. Please note, however, that even after termination of your student relationship with the University, GCU may still need to retain your personal data to satisfy its obligations to keep certain records for particular periods under applicable law. Visit Records Retention Schedule.

Making sure your personal information is accurate

GCU strives to ensure that all personal data remain current and accurate. If you become aware of any incorrect information held by the University you have the right to request that this is rectified.  There are particular areas where the University relies upon you to inform it of any changes to your personal data; for example contact and next of kin details. Our website tells you how to update us if your contact or other personal details change, visit Your Student Record.

Your rights and changes to this policy

You have the right to request access to, copies of and rectification or erasure of personal data held by the University and to object to processing. If we have asked for your consent in order to process your personal data you can withdraw this consent in whole or part at any time. We will explain the consequences of doing so in any particular case if you contact us to withdraw consent. 

For further information please contact the Data Protection Officer as detailed below.


Student email is provided by a third party. This requires the University to disclose some personal information to this third party in order to provide the service. Students should refer to the third party's terms of use and privacy policy which are available at the login screen.

This personal data is held in accordance with the Data Protection Act and will be stored either in the EU or, if stored outside the EU will have a level of protection the EU deems adequate for the rights and freedoms of Data Subjects in relation to the processing of their personal data. You, as the student, and not the University, are the Data Controller of any personal data stored within your email account.

Graduation ceremonies

Graduation ceremonies are public events. Audio and visual images of ceremonies may be made publically available via the sale of DVDs and live broadcast at the venue, on campus and on the Internet. Names of graduands, including those graduating in absentia, are published in the graduation programme. Lists are published in the press and you will be offered the opportunity to opt out of this.

The University may take photographs and other images for possible use in University publicity and promotional material. Graduands who do not wish to be included must inform the photographer at the time the photograph is taken.

A separate Privacy Notice is provided for Alumni Engagement and GCU Foundation.


The University’s premises are monitored by CCTV systems for the purposes of public safety and the prevention and detection of crime. CCTV footage may also be used for investigations or proceedings arising under the University’s regulations, codes and policies.

Data Protection contact details and further information

We will publish any changes we make to this data protection policy on our website (

If you are not happy to agree to the processing of your personal information as described above please contact the University’s Data Protection Officer.

You can do this by email:; telephone: 0141 331 8392 or post;

Data Protection Officer, Department of Governance, Glasgow Caledonian University, Cowcaddens Road, Glasgow, G4 0BA

If you have any issues about this statement or the way the University has handled your personal information please contact the University Data Protection Officer in the first instance.  If you are dissatisfied with the response from the University you have the right to lodge a complaint with the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113