Student Wellbeing - Privacy Notice


This Privacy Notice is designed to explain how and why information about individuals in the following categories is used and managed:

  • Students and Applicants using the services of Student Wellbeing

All of the personal information will be treated in accordance with the terms of the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). This means that confidentiality will be respected and that appropriate security measures will be taken to prevent unauthorised disclosure. This notice is intended to meet the transparency requirement of the legislation and to ensure that all individuals in the categories above know how their data will be processed.

Using your personal information

Who will process my information?

Under Data Protection law the University is the “data controller”.  This means that the University is responsible for how it uses and processes your information and complying with requests relating to your personal data.

The Student Wellbeing Team need to use students’ and applicants’ personal information to support students through their time at the University.  Information is needed to ensure that reasonable adjustments are put in place for disabled students.

Why do we collect and use your personal information?

The Student Wellbeing Team within the University is required to process and retain certain information relating to students/applicants to ensure that they are supported throughout their time at University.  The Student Wellbeing Team also uses this information to monitor and improve services.

If you choose to do so, you can receive communications from the Service after you have left the University and can take part in research.

Keeping information updated

The University strives to ensure that all personal information is accurate and up to date.

Students keep their information up to date during the course of their studies.

How long is the information kept?

The University will retain your information only for as long as necessary for the purposes described. Further information is available in the University Records Retention Schedules:  

Where do we obtain information from?

We obtain information directly from students and applicants, when they provide information during an enquiry in person, by telephone or by email:

  • Information you have provided on your application form (including applications made via a third party such as UCAS and other partner organisation
  • Information you provide to the University during the course of your study; and, the purposes of external study or exchange
  • Information provided by partner organisations such as other educational establishments for the purposes of external study or exchange

What information is being collected and used?

Data will consist of the information provided by the “data subject” or a company acting on behalf of the University.  Information may be in hard copy or electronic format.  

The personal information the University holds about you is obtained from a number of sources including information which you provide directly to us:

  • Personal information provided by you when enquiring and discussing your disability and/or wellbeing issue
  • Information concerning your medical condition or impairment, which may include your GP details, diagnostic reports or letters confirming diagnosis, confirmation of engagement with community mental health support and/or hospital attendance etc.
  • Details of support provided by previous education providers e.g. school, college

Special category personal information is also processed where it is necessary and lawful for us to do so.  In most cases you have the option whether to provide this information or not.  This refers to data revealing:

  • Racial or ethnic origin
  • Political opinion
  • Religious or philosophical beliefs
  • Trade Union membership
  • Physical or mental health
  • Sex life or sexual orientation

Data relating to criminal convictions and offences is also subject to additional protection.

Who is the information shared with?

Your information will be shared internally only with those individuals who require it in the course of their duties.

The University may be required to share your personal information with external organisations. This may happen due to a statutory or legal obligation.

We record and share data with HESA regarding the nature of your condition or impairment, and whether you are in receipt of DSA.  We would not share your personal data without your consent other than in the circumstances noted below:

  • If a child’s physical or emotional wellbeing is at risk
  • If we believe you are in danger of seriously harming yourself or another person

We will disclose personal data where we have been given information which would render us liable to civil or criminal court procedure should it not be disclosed.

How is the information kept securely?

Information is kept securely on University equipment in line with University Information Security and Data Protection Policies.  Access is restricted to only those staff or authorised agents who require it and on a “need to know” basis.

Will the information be used for automated decision-making?


Is the information transferred outside the European Union?



Your rights

You have the right to:

  • Find out what personal data we process about you and to request a copy of the data
  • Ask us to correct inaccurate or incomplete data

Withdraw consent to process your personal data, if you were asked for and provided consent 

If you think we are acting unfairly or unlawfully you can:

  • Object to the way we are using your data
  • Complain to the UK Information Commissioner’s Office

Under certain conditions you also have the right to ask us to:

  • Restrict the use of your data
  • Erase your information or tell us to stop using it to make decisions about you
  • Provide you with a portable electronic copy of data you’ve given us

Please contact us if you wish to exercise/enquire about any of these rights.

Contact Details

Data Protection Officer (DPO)

Department of Governance

Britannia Building

Glasgow Caledonian University

Cowcaddens Road


G4 0BA


Legal basis for using your information

The legal condition which enables the University to process personal information is found in Article 6 of the General Data Protection Regulation (GDPR).  In particular we rely on:

  • Article 6(1)(a) consent
  • Article 6(1)(d) vital interests

Where special categories of data are processed we will have your explicit consent or another legal reason within Article 9(2) of GDPR will apply.

Further information

The Information Commissioner’s Office website:

The University’s Data Protection webpages:

Further information is available in the Student Privacy Notice and Staff Privacy Notice: