Skip to main content

Student Privacy Policy

This privacy notice relates to your personal data as necessary for enrolment and studying at University of the Arts London. During your time at UAL you may sign up to other services or programmes for which other privacy notices will apply, e.g. a placement, counselling, a short course, ArtsTemps employment.

Please see the UAL Privacy Information webpage for UAL’s general information as a Data Controller, details of our Data Protection Officer and your rights under the EU General Data Protection Regulation and the UK Data Protection Act 2018.

Data collected or created and purpose

UAL processes personal information taken from your application, enrolment form, agents, referees or other third parties supporting your application, information and documentation you provide in support of your application, and information collected or created during your time with us such as tuition notes and course progression, attendance record, your photograph, correspondence, feedback and other comments, details of payments made and received or debts owed, complaints, enquiries, and information you may choose to provide such as special requirements, health or diversity information and marketing preferences.

We use this information to provide your course and support your studies and welfare, to verify your identity, maintain contact with you (by post, email and phone), offer additional related services and information, monitor and enforce the conditions of our agreement with you, to manage payments, for credit scoring and assessment, debt tracing, to manage your use of facilities (e.g. IT, libraries) and participation at events, to support disciplinary, complaint, and quality assurance processes and arrangements, to fulfil our legal obligations, for internal and external auditing purposes and - in anonymised form - to report on our activities and monitor diversity. We will also store the details of the emergency contacts you have provided in case we need to contact them.

CCTV images, card access data and data recording your interaction with UAL IT systems (including wifi and UAL email) are used to maintain the security of the University, its staff and students. In exceptional circumstances we may need to analyse your content to help us detect abuse such as spam, malware, and illegal activity.

Your personal data may be used for other purposes in accordance with an appropriate legal basis, for example with your consent or through other agreements you enter into during your time with us, which will be covered on separate privacy notices at the time.

Please see our cookies notice for further information about what information may be automatically collected when you visit our websites.

GDPR legal bases for processing

In most cases, information relating to you and your studies, including any support services provided and information created by your tutors or others during your studies, will be processed under the GDPR legal basis 6(1)b ‘necessary for the performance of a contract’. Your enrolment and the student terms and conditions form the contract between you and UAL.

Where required by a UK law, processing may occur under basis 6(1)c ‘necessary for compliance with a legal obligation’.

CCTV images, card access data and data recording your interaction with UAL IT systems - including your use of UAL email - will be processed under the basis 6(1)f ‘legitimate interests’ to maintain security for the University, its assets, staff and students and to monitor the use of our premises and systems. Your photograph may also be used to help tutors and other staff members identify you in classrooms and at events.

Marketing contact may sometimes be made under 6(1)f ‘legitimate interests’ if related to your studies, but otherwise will be with your consent. In either case you can withdraw consent or unsubscribe from direct marketing by clicking an ‘unsubscribe’ link or contacting the sender directly.

Special Category (Sensitive) Data

GDPR ‘special category’ personal data includes:

  • Information relating to disabilities, health or dietary requirements provided for the purposes of making reasonable adjustments
  • Information relating to ethnicity, sexuality or religion for the purpose of statistical monitoring

This type of data will normally be processed under the legal basis 9(2)a ‘explicit consent’ if you agree to provide it. You can withdraw consent at any time by contacting the department which collected it, in which case this data will be deleted.

If provided, some special category data will be shared with the Higher Education Statistics Agency (HESA/Jisc) and the Education and Skills Funding Agency (ESFA) under basis 9(2)j ‘processing is necessary for…statistical purposes’. Special category data may also be processed under 9(2)c Vital Interests if necessary to save your life or that of others, or under 9(2)g Substantial Public Interest if necessary for safeguarding children or vulnerable adults or provide counselling, where it is not practical or appropriate to obtain your consent.

Information relating to declared criminal convictions or any unspent criminal convictions will be collected under 9(2)g Substantial Public Interest in order to identify potential threats to children and vulnerable adults.

Data storage, access and sharing with third parties

Your data will be stored on UAL hosted systems and databases, which can be accessed by relevant staff employed by the University. Your name and UAL email address will be made available to all staff and students through the UAL internal online directory service.

We will sometimes need to share or provide access to your personal data with third parties who are engaged as data processors on our behalf. These may include course tutors or support staff working through their own company or organisations outside of UAL. Data will always be shared within the EEA, with a territory deemed adequate by the EU, or with appropriate safeguards in place in line with GDPR, unless you consent otherwise or enter into a separate agreement that covers the processing.

Under legal basis 6(1)f Legitimate Interests, we will share your name, course and contact details with the Arts Student Union ("Arts SU") to facilitate automatic membership to its services, clubs, societies and events which are available to all students. If you do not want to be a member of Arts SU please opt out in accordance with options provided to you on enrolment or email to cancel your membership.

On completion of your course, your results will be published on a public notice board or on our website, shared with Higher Education Degree Datacheck (HEDD) degree verification and provided to third-parties if references are requested directly.

If you apply to attend a graduation ceremony your first name, initials, surname and degree title will be printed in the souvenir programme and may also appear on some UAL merchandise. You must inform the graduation team in writing at before the ticket application deadline if you wish to opt out of this.

UAL may also share your data with third parties to fulfil a legal obligation or for other legal purposes.

Personal data may be shared with the appropriate authorities if necessary for the prevention or detection of crime, the apprehension of offenders, or the collection of taxes.

Other sharing of your information or storage outside of UAL will be covered in privacy notices at the point you sign up to the service or provide the information for that specific purpose, e.g. surveys, student support services.


After you graduate core student records will be kept permanently to provide references. Your core student record comprises of your title, official name, name used (if different), date of birth, student ID number, course and dates of study, transcript of results and award attained.

Your name and contact details will be retained after the end of your studies in order to provide alumni services and contact, including continued library access. Details will be provided by Development and Alumni Services near the point of graduation.

Personal data which relies on your consent as a legal basis will be deleted if you withdraw consent.

Other data will be deleted within 6 years after completion of study.

Automated decision making and profiling

Your personal data will not be used for automated decision making or profiling without your consent.

Examples of some organisations we share your personal data with include:

Type of data

Shared with


GDPR legal basis

Course details, basic biographical data

Higher Education Statistics Agency (HESA/Jisc), the Education and Skills Funding Agency (ESFA) and Office for Students

Statistical reporting

6(1)(e) Necessary for a task in the public interest

Contact details

Office of Students, Higher Education Statistics Agency (HESA/Jisc)

To receive the National Student Survey and the Graduate Outcomes survey

6(1)(e) Necessary for a task in the public interest

Contact details

Eventbrite and other providers

To invite you to events and manage the booking

6(1)b Performance of a Contract, 6(1)f Legitimate Interests

Contact details

JISC survey tool, SurveyMonkey and similar

To obtain feedback on your course and our services

6(1)(e) Necessary for a task in the public interest

Email address

Campaign Monitor or MailChimp (using EU Standard Contractual Clauses)

Bulk emailing to students about course or campus issues

6(1)b Performance of a Contract

Name, student ID and location within card access data

Bouyges and subcontractors

To maintain the security of University sites

6(1)f Legitimate Interests

User ID


To access University IT services

6(1)b Performance of a Contract

Basic identifying details and attendance status

Student loans company, fee payers

To confirm attendance or non-attendance

6(1)(e) Necessary for a task in the public interest (the proper administration of student funding support)

Basic identifying details, attendance status, progression, attainment, conduct and any academic integrity concerns.

Sponsors, agents or home institutions (if applicable)

To confirm contractual conditions are met

6(1)b Performance of a Contract

Full student details

Birkbeck College University of London and other partner Universities

To facilitate joint degrees (where applicable)

6(1)b Performance of a Contract

ID, passport, visa, attendance and award details

UK Visas and Immigration

To confirm immigration status – overseas students only

6(1)c Legal Obligation

Banking and payment details

Unit 4 N.V. (Agresso Business World database), Worldpay, National Westminster Bank Plc, Lloyds Banking Group Plc

To process payments and financial details

6(1)b Performance of a Contract (fees) and 6(1)f Legitimate Interests (payments for goods and services)

Login Details, course notes, comments, voice, images, etc.

Blackboard Inc, Panopto, Microsoft Teams etc (all using EU Standard Contractual Clauses)

To facilitate course collaboration, lecture capture and remote learning (Other course collaboration tools may also be used)

6(1)b Performance of a Contract

Name, address, email address, date of birth and nationality

Local Authorities

To facilitate electoral registration

6(1)(e) Necessary for a task in the public interest

Identity and contact details, amounts owing

Debt collection agencies acting on our behalf

To recover debts (if applicable)

6(1)b Performance of a Contract

User names, contact details, UAL course or programme, items borrowed, circulation/fines history

PTFS Europe (Koha library database)

To track use of library services needed to support learning

6(1)b Performance of a Contract

Student ID, Name, DOB, Contact details, Course details

PTFS Europe


To allow graduates to request a certificate electronically.

6(1)b Performance of a Contract