This Notice explains how we will collect and use your personal data in accordance with data protection legislation. The University will share data appropriately between different departments or services, but this does not mean that all of your data is available to all staff members.  Where parts of the University process data in a very specific way for a project or function they may present you with an additional privacy notice.

We are the data controller for personal data that we process about you.

Throughout this Notice, “University”, "we", "our" and "us" refers to the University of Leeds, LS2 9JT.

"you" and “your” refers to those expressing an interest in becoming a student at the University (both prior to and at formal application stage), together with those who later become a registered student (including apprentices) at the University.  This notice is also for those who engage with University outreach and widening participation activities, including students in schools, colleges and the community.

This notice does not form part of any student contract.

Anything you are not clear about 

If there is anything you are unclear about, please contact our Data Protection Officer at dpo@leeds.ac.uk.

We obtain personal data about you from the following sources:

• from you, for example when you provide your details for University-run activities or register as a student with us;
• from 3rd party sources where data is required, for example, to enable an application to, or engagement with, the University, to support the delivery and assessment of University services (including the provision of teaching) and from other institutions involved in the administration of University services (including those related to the payment and recovery of fees and other charges). When we obtain personal data from 3rd party sources we will look to ensure that there is a lawful basis to do so;
• data that we generate about you, such as during tutorials and in connection with your attendance, performance and wellbeing at the University;
• your school or previous educational establishments or employers if they provide references to us;
• fellow students, family members, friends, visitors to the University and other contacts who may provide us with information about you if and when they contact us, or vice versa.

The usual categories of personal data we expect to process about you include (but are not limited to):

• Biographical data to help us identify you, including contact details (and details of your next of kin or trusted contact).
• Academic data in relation to the administering and assessment of your course, including details of disciplinary complaints or decisions about you.
• Data about your ethnicity, gender, religion and sexual orientation. (This is classed as “special category data”.)
• Health-related data including in relation to applications for mitigating circumstances, applications for disability support and contact with the Student Counselling and Wellbeing Service. (This is also special category data.)
• Bank details in order that we can process payments and verify in accordance with financial sanctions regulations.
• Financial data in order that we can process means tested support.
• Communcations that you have with us, and communication that we have with 3^rd parties about you.
• Details of any relevant criminal convictions, allegations or charges that we ask you to declare to us either when you apply to us, or whilst you are a student, or which are reported to us, and of any Disclosure and Barring Service checks that we request.

More information is available for undergraduate and postgraduate admissions at:

Applicants and students with a criminal record

Disclosing criminal offences whilst a student at the University

In general terms, we process your personal data for the administration and delivery of your student contract with us, including the use of our services and facilities.

We also process your personal data in order to understand the types of interactions we have with students and prospective students and to enhance the support that we can provide.  Where we anonymise your data we will continue to use it for statistical analysis without informing you.

We may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests. In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent.

We may share your personal information with 3rd parties where required by law, where it is necessary to administer the contract with you or where we have an expectation to uphold the public interest or other legitimate interest in doing so.

Where information is shared with 3rd parties, we will seek to share the minimum amount of information necessary to fulfil the purpose.  All our 3rd party service providers are required to take appropriate security measures to protect your personal information.

We are required to return information (that will include your personal data) to the Higher Education Statistics Agency (HESA). Please see HESA’s collection notice.

We do not, and will not, sell your data to 3rd parties.

The University has also published separate policies and guidance which may be applicable to you in addition to other privacy notices. It is important that you read this privacy notice together with other applicable privacy notices.

The other relevant privacy notices include:

• Staff Privacy Notice
• Advancement Privacy Notice
• Generative AI for Taught Students
• Website and Cookies
• Information Protection Policy

Automated individual decision making

This is where we may make decisions automatically about you without human intervention.

Regarding University Advancement activity please see Advancement Privacy Notice.

Regarding assessment of fees status and suitability for further financial assistance please see Student Finance.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

We will from time to time communicate with you by email, post and telephone about various services provided by the University. If, at any stage, you are concerned about the content of these communications, e.g. marketing information that you don’t think is relevant to you, or you wish to change the method of communication, please use the unsubscribe function in the correspondence you have received.  We will however continue to contact you about matters relating to the Student Contract and any matters ancillary to the contract.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  In addition, we limit access to your personal information to those employees, agents, contractors and other 3rd parties who have a business requirement to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are required to do so.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

You have the right to:

• withdraw consent at any time where that is the legal basis of our processing;
• access your personal data that we process;
• rectify inaccuracies in personal data that we hold about you;
  • be forgotten, that is your details to be removed from systems that we use to process your personal data;
  • restrict the processing in certain ways;
• obtain a copy of your data in a commonly used electronic form; and
• object certain processing of your personal data by us.

Please be aware that these rights are subject to certain conditions and exceptions as set out in the data protection legislation.

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see the ICO Website

It is important that the personal information we hold about you is accurate. Please keep us informed if your personal information changes during your study with us and until after you have graduated or otherwise completed your studies.

Here is a brief explanation of the grounds on which we rely in order to process your personal data.

• Public task: processing necessary for the performance of a task carried in the public interest – the University is an educational establishment and in particular its educational activity is conducted in a public interest (including your interest and the interest of others).
• Substantial public interest: processing “special categories” of data where necessary for reasons of substantial public interest.
• Legitimate interests: processing is necessary for the purposes of the legitimate interest of the University or a 3rd party subject to overridden interests of the data subject – the University (and sometimes 3rd parties) has a broad legitimate interest in activities that connect to the activities and education of students. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of students, it will pursue those interests.
• Consent: on specific occasions the University will only process certain data if you consent e.g. on registration, you only need to provide certain “special categories” of data if you agree to that.
• Explicit consent: the University will process special category data about you with your consent.
• Vital interests: for the purpose of protecting the vital interests of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies.
• Contract: necessary for the performance of your student contract – on many occasions the University will process your data to enable it to meet its commitments to you.
• Legal obligation: the University has to process, and share, some personal data in accordance with the legal obligations placed on it. Sometimes this will include special category data.

Sometimes the  the above grounds will overlap. The University also reserves the right to rely upon other grounds that are not referred to in the table.

If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice, please contact our Data Protection Officer, dpo@leeds.ac.uk

Our general postal address is University of Leeds, Leeds LS2 9JT, UK.

Our data controller registration number provided by the Information Commissioner's Office is Z553814X

We shall inform you of any changes to this Notice. Notification will be through the appropriate medium of communication e.g. where our main contact with you is by email we will email you.